fix: render carry-forward findings as arrays

[randlee]

Why

sc-compose JSON autoescape serializes an ordinary string as a JSON string. The carry-forward contract intentionally supplies a pre-serialized JSON array string, so rendering it without an explicit trust-boundary filter changes the value from an array into the string "[]".

This is the surgical port of atm-core commit 37c480f40 and the behavior already present in sc-runtime PR #6:

• add | safe only to carry_forward_findings_json in the seven assignment templates;
• bump each affected template patch version;
• prove a non-empty payload renders as a typed JSON array in all seven templates.

No agent prose or repository policy changed.

Best-practice rationale

MiniJinja's safe filter is appropriate here because the input contract explicitly requires a pre-serialized JSON fragment. Native typed values should use JSON serialization instead; this PR does not broaden safe to ordinary strings.

Validation

• fresh Luna cross-repo reproduction: sc-lint develop rendered a string; the corrected templates rendered arrays
• focused orchestration regression: PASS
• just lint: PASS
• just test: PASS
• git diff --check: PASS