Fix hosted review policy context

[gvorwaller]

Summary

• resolve review policy through the shared helper for both local and hosted handlers
• make hosted routes use td's documented trusted default while preserving process-wide overrides
• centralize policy resolution across review, approve, close, and transition discovery

Bug

Hosted handlers have no local BaseDir, so review-policy checks skipped the resolver and silently fell back to strict. An involved td-watch browser session therefore received only reject in available_transitions, even though the default policy is trusted and an attributed or acknowledged approval is valid.

Verification

• make test
• regression test fails under the old fallback with transitions=[reject], then passes with this change
• focused go test ./internal/serve ./internal/api ./internal/features