Polecat allocator can assign infrastructure agent names (witness, refinery)

Bug Description

The polecat allocator in Gas Town can assign names that conflict with infrastructure agents. In my case, gt sling allocated "witness" as a polecat name, which is confusing because witness is supposed to be an infrastructure agent that monitors polecat health.

Steps to Reproduce

1. Run gt sling <bead-id> <rig> --create multiple times
2. Eventually the allocator assigns "witness" as a polecat name
3. This creates a tmux session gt-<rig>-witness that conflicts conceptually with the infrastructure witness

Expected Behavior

Polecat names should come from a pool that does not include infrastructure agent names:

• OK: alpha, bravo, charlie, delta, guzzle, nitro, rust, chrome, etc.
• NOT OK: witness, refinery, deacon, mayor

Actual Behavior

gt sling af-xyz my_rig --create
Target is rig 'my_rig', spawning fresh polecat...
Allocated polecat: witness   # <-- This should not happen

Impact

• Confusing when monitoring sessions (tmux list-sessions)
• Could potentially cause conflicts if the real witness infrastructure tries to use the same session name
• Makes it harder to distinguish infrastructure agents from worker polecats

Suggested Fix

Add infrastructure agent names to a blocklist in the polecat name allocator, or use a separate namespace/prefix for polecats vs infrastructure.