fix: Security fixes and docs updates (gt-jsm2s, gt-d47q0, gt-orujk)

- convoy.go: Escape single quotes in SQL to prevent injection
- engineer.go: Add comment clarifying test command trust model
  (config.json is trusted infra, not PR-controlled)
- agents.go, prime.go, mayor.md.tmpl: Fix 'gt polecats' -> 'gt polecat list'

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/cmd/agents.go

@@ -64,7 +64,7 @@ var agentsCmd = &cobra.Command{
 	Long: `Display a popup menu of core Gas Town agent sessions.
 
 Shows Mayor, Deacon, Witnesses, Refineries, and Crew workers.
-Polecats are hidden (use 'gt polecats' to see them).
+Polecats are hidden (use 'gt polecat list' to see them).
 
 The menu appears as a tmux popup for quick session switching.`,
 	RunE: runAgents,