[uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings)

### Context
UK AI Open Code Risk & Resilience Governance run (2026-08-14, 7-day lookback) — see discussion report for full analysis.

### Tier
**Tier B — Open With Conditions**

### Risk-scoring breakdown
| Dimension | Rating |
|---|---|
| Exposure amplification | Low |
| Patchability | High |
| Detectability | High (caught by code scanning) |
| Operational fragility | Low |
| Ownership confidence | Medium |
| **Overall** | **Low-Medium** |

### Finding
Two open code-scanning alerts (warning severity), rule `workflow-go-graphql-injection-sprintf`, both in `pkg/cli/project_command.go`:
- Line 269
- Line 272

These flag GraphQL query strings built via `Sprintf`-style formatting, which risks GraphQL injection if any interpolated value originates from untrusted/user-controlled input.

### Remediation action
Review both call sites and either (a) confirm all interpolated values are compile-time constants or already-validated/allow-listed identifiers (and add a code comment/test asserting this), or (b) migrate to parameterized GraphQL queries (variables) instead of string formatting to eliminate the injection class entirely.

### SLA urgency
**High** — target remediation or documented risk acceptance within 14 days.

### Report
See the full UK AI Open Code Risk & Resilience Governance discussion report generated in this run for asset graph, control verification, and full remediation queue.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/31815470342) · auto · 51.5 AIC · ⌖ 2.25 AIC · ⊞ 8.7K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)