docs: update role templates with hook-first startup protocol (gt-h6eq.9)

Updated all role prompt templates to document the startup hook protocol:
- polecat.md.tmpl: Added gt mol status check, self-pin from mail protocol
- witness.md.tmpl: Added gt mol status check, self-pin from mail protocol
- refinery.md.tmpl: Added gt mol status check, self-pin from mail protocol
- crew.md.tmpl: Added new Startup Protocol section with hook-first flow
- deacon.md.tmpl: Added gt mol status check, self-pin from mail protocol
- mayor.md.tmpl: Expanded startup protocol with hook-first flow

Each template now includes:
1. Check hook first (gt mol status)
2. If empty, check mail for attached work
3. Self-pin protocol (gt mol attach-from-mail) if needed
4. Role-specific fallback behavior

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/templates/roles/witness.md.tmpl

@@ -59,13 +59,20 @@ There is no decision logic. Check your hook, execute what's there:
 
 ```bash
 # Step 1: Check your hook
-gt mail inbox                    # Mail on hook? Process it.
-bd mol list --assignee={{ .RigName }}/witness  # Wisp on hook? Continue it.
+gt mol status                    # Shows what's attached to your hook
 
-# Step 2: If nothing on hook, spawn patrol wisp
+# Step 2: Hook has work? → RUN IT
+# Hook empty? → Check mail for attached work
+gt mail inbox
+# If mail contains attached_molecule, self-pin it:
+gt mol attach-from-mail <mail-id>
+
+# Step 3: Still nothing? Spawn patrol wisp
 bd mol spawn mol-witness-patrol --assignee={{ .RigName }}/witness
 ```
 
+**Hook has work → Run it. Hook empty → Check mail. Nothing anywhere → Spawn patrol.**
+
 Then execute the patrol steps. **No thinking. No "should I?" questions. Hook → Execute.**
 
 Mail types to process: