fix: Security fixes and docs updates (gt-jsm2s, gt-d47q0, gt-orujk)

- convoy.go: Escape single quotes in SQL to prevent injection
- engineer.go: Add comment clarifying test command trust model
  (config.json is trusted infra, not PR-controlled)
- agents.go, prime.go, mayor.md.tmpl: Fix 'gt polecats' -> 'gt polecat list'

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/cmd/convoy.go

@@ -577,8 +577,10 @@ func getTrackedIssues(townBeads, convoyID string) []trackedIssueInfo {
 	dbPath := filepath.Join(townBeads, "beads.db")
 
 	// Query tracked dependencies from SQLite
+	// Escape single quotes to prevent SQL injection
+	safeConvoyID := strings.ReplaceAll(convoyID, "'", "''")
 	queryCmd := exec.Command("sqlite3", "-json", dbPath,
-		fmt.Sprintf(`SELECT depends_on_id, type FROM dependencies WHERE issue_id = '%s' AND type = 'tracks'`, convoyID))
+		fmt.Sprintf(`SELECT depends_on_id, type FROM dependencies WHERE issue_id = '%s' AND type = 'tracks'`, safeConvoyID))
 
 	var stdout bytes.Buffer
 	queryCmd.Stdout = &stdout