fix: Security fixes and docs updates (gt-jsm2s, gt-d47q0, gt-orujk)

- convoy.go: Escape single quotes in SQL to prevent injection
- engineer.go: Add comment clarifying test command trust model
  (config.json is trusted infra, not PR-controlled)
- agents.go, prime.go, mayor.md.tmpl: Fix 'gt polecats' -> 'gt polecat list'

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/refinery/engineer.go

@@ -346,6 +346,8 @@ func (e *Engineer) runTests(ctx context.Context) ProcessResult {
 			fmt.Fprintf(e.output, "[Engineer] Retrying tests (attempt %d/%d)...\n", attempt, maxRetries)
 		}
 
+		// Note: TestCommand comes from rig's config.json (trusted infrastructure config),
+		// not from PR branches. Shell execution is intentional for flexibility (pipes, etc).
 		cmd := exec.CommandContext(ctx, "sh", "-c", e.config.TestCommand)
 		cmd.Dir = e.workDir
 		var stdout, stderr bytes.Buffer