Tool calls intermittently leaked as plain text (stray 'course' prefix) instead of executing (v1.0.61)

### Describe the bug

In **v1.0.61**, the assistant's tool calls are intermittently rendered as **plain text in the chat transcript** instead of being executed. The leaked text is an `` block, consistently prefixed with a stray literal word **`course`**. When this happens the tool **does not run at all** — background agents are never started, shell/SQL/file tool calls never execute — and the user just sees raw markup.

Example of what appears in the chat (verbatim shape):

```
course

tester
...
background
...
...

```

### Observed pattern (high confidence, reproduced many times in one session)

- Happens **far more frequently after updating to 1.0.61**.
- Empirically: when the assistant's turn **begins with the tool call** (tool call is the very first content of the message), it executes reliably. When **narrative text precedes** the tool call in the same turn, the call tends to leak as text (with the `course` prefix) and is **not** executed.
- The leaked block is often **indented** (as if nested in a list/quote), and the leading token is consistently the word `course`.

### Impact

- Sub-agents / background tasks silently fail to start.
- Shell, SQL, and file-edit tool calls silently don't run.
- The user must notice the leak and re-prompt, repeatedly. Very disruptive for multi-step / agent-orchestration workflows.

### Expected behavior

Tool calls should always be parsed and executed regardless of any preceding narrative text in the same assistant turn. The literal `course` prefix should never appear.

### Environment

- GitHub Copilot CLI **1.0.61**
- OS: Windows
- Model: Claude Opus 4.8 (also observed while orchestrating custom sub-agents)

### Additional possibly-related observation

A separate input/rendering desync was also seen: the session indicated an **image attachment that the user did not actually send**. May share a root cause with the tool-call/text desync above.

No file or test is identified in the report. Reproduce on Windows with Copilot CLI 1.0.61, comparing turns where the tool call starts the message with turns containing preceding narrative, and inspect the parsing/rendering path for the leaked indented invoke block and stray “course” prefix. Done means tool calls execute in both cases and the raw markup and prefix no longer appear.

Escrita pelo modelo de indexação a partir do texto da issue.