feat: Tool-level logging for slash command sessions [hands-off keyboard]

## Feature Request
Implement tool-level logging to track every tool call and bash command executed during slash command sessions. This enables hands-off keyboard workflows by providing visibility into what Claude is doing.

## Problem
Currently we can log when slash commands start, but we can't see:
- Which tools are being called during execution
- How many times each tool is used
- What bash commands are run
- How long sessions take

This blocks hands-off operation because you can't trust what you can't see.

## Proposed Approaches

### Option 1: Claude Code Hook (Ideal)
If Claude Code provides hooks/callbacks for tool execution, use them to log:
```
2025-01-27 10:30:45 | TOOL_USE | session-123 | mcp__github__get_issue
2025-01-27 10:30:46 | BASH_CMD | session-123 | npm test
```

### Option 2: MCP Server Wrappers (Current capability)
We already have MCP logging infrastructure in `mcp/utils/mcp-logging.sh`:
- Extend `mcp_log_tool_call()` to include session ID
- Pass session ID through environment variable
- Each MCP wrapper logs its calls

### Option 3: Command Template Instrumentation
Modify slash command templates to explicitly log before each known tool pattern:
- Before `mcp__github__*` calls
- Before bash blocks
- Requires template maintenance but works today

### Option 4: Claude's Built-in Logging
Research if Claude Code has native logging we can tap into:
- Check for log files in ~/.claude/
- Look for verbose/debug modes
- Explore config options

## Success Criteria
- See every tool call for a session in the log
- Track usage patterns and frequencies
- Enable performance analysis (what's slow?)
- Build trust for hands-off operation

## Benefits
- **Trust**: See exactly what Claude does
- **Optimization**: Identify redundant calls
- **Debugging**: Understand failures
- **Hands-off**: Confidence to walk away

Related: #593 (permissions), #594 (analytics)

Start by reading mcp/utils/mcp-logging.sh and checking ~/.claude/ for existing logging or debug hooks; compare those findings with the four proposed approaches and related issues #593 and #594. Done means a selected implementation records every tool call and bash command with session IDs, usage and frequency, and timing for a slash-command session.

Written by the indexing model from the issue text.