hardening: migrate maint SQL helpers to prepared variants

[somethingwithproof]

Problem

plugin_maint still contains raw db_fetch_assoc helper usage in schedule and filter-list paths.

Proposed change

• migrate straightforward read queries to prepared helper variants
• preserve query semantics and output behavior
• keep scope focused on safe, mechanical conversions

Tests

• add regression checks for converted prepared helper usage in touched files
• run syntax checks for modified files and new test script