fix: Security fixes and docs updates (gt-jsm2s, gt-d47q0, gt-orujk)

- convoy.go: Escape single quotes in SQL to prevent injection
- engineer.go: Add comment clarifying test command trust model
  (config.json is trusted infra, not PR-controlled)
- agents.go, prime.go, mayor.md.tmpl: Fix 'gt polecats' -> 'gt polecat list'

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/cmd/prime.go

@@ -332,7 +332,7 @@ func outputWitnessContext(ctx RoleContext) {
 	fmt.Println()
 	fmt.Println("## Key Commands")
 	fmt.Println("- `gt witness status` - Show witness status")
-	fmt.Println("- `gt polecats` - List polecats in this rig")
+	fmt.Println("- `gt polecat list` - List polecats in this rig")
 	fmt.Println()
 	fmt.Println("## Hookable Mail")
 	fmt.Println("Mail can be hooked for ad-hoc instructions: `gt hook attach <mail-id>`")