fix: address review findings (rollback mainline, audit flag, confidence gate, test pattern, jq args)

- git revert uses --mainline 1 for merge commits
- inject dispatch passes all args so --audit flag is reachable
- confidence gate defaults to 0.0 (triggers gate) instead of 0.7 (bypasses)
- test-first grep uses word-boundary patterns to avoid false positives
- jq uses --arg instead of string interpolation for safe filtering

lib/archeflow-memory.sh

@@ -296,7 +296,7 @@ cmd_audit_check() {
 
   # Get lessons injected for this run
   local injected
-  injected=$(jq -c "select(.run_id == \"$run_id\")" "$AUDIT_FILE" 2>/dev/null || true)
+  injected=$(jq -c --arg rid "$run_id" 'select(.run_id == $rid)' "$AUDIT_FILE" 2>/dev/null || true)
 
   if [[ -z "$injected" ]]; then
     echo "No audit records for run $run_id." >&2
@@ -319,7 +319,7 @@ cmd_audit_check() {
 
     # Get lesson description
     local lesson_desc
-    lesson_desc=$(jq -r "select(.id == \"$lid\") | .description" "$LESSONS_FILE" 2>/dev/null | head -1)
+    lesson_desc=$(jq -r --arg lid "$lid" 'select(.id == $lid) | .description' "$LESSONS_FILE" 2>/dev/null | head -1)
     [[ -z "$lesson_desc" ]] && continue
 
     # Check keyword overlap between lesson and findings
@@ -515,7 +515,7 @@ case "$COMMAND" in
     cmd_extract "$1"
     ;;
   inject)
-    cmd_inject "${1:-}" "${2:-}"
+    cmd_inject "$@"
     ;;
   add)
     [[ $# -lt 2 ]] && { echo "Usage: $0 add <type> <description>" >&2; exit 1; }

lib/archeflow-rollback.sh

@@ -48,7 +48,7 @@ if timeout 300 bash -c "$TEST_CMD"; then
 fi
 
 echo "Tests FAILED — reverting merge..."
-git revert --no-edit HEAD
+git revert --no-edit --mainline 1 HEAD
 
 # Emit event if event script exists
 if [[ -x "$SCRIPT_DIR/archeflow-event.sh" ]]; then