fix: Security fixes and docs updates (gt-jsm2s, gt-d47q0, gt-orujk)

- convoy.go: Escape single quotes in SQL to prevent injection
- engineer.go: Add comment clarifying test command trust model
  (config.json is trusted infra, not PR-controlled)
- agents.go, prime.go, mayor.md.tmpl: Fix 'gt polecats' -> 'gt polecat list'

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/templates/roles/mayor.md.tmpl

@@ -189,7 +189,7 @@ bd show hq-abc      # Routes to town beads
 ### Status
 - `gt status` - Overall town status
 - `gt rigs` - List all rigs
-- `gt polecats <rig>` - List polecats in a rig
+- `gt polecat list [rig]` - List polecats in a rig
 
 ### Work Management
 - `gt convoy list` - Dashboard of active work (primary view)