Tool calls intermittently leaked as plain text (stray 'course' prefix) instead of executing (v1.0.61)

### Describe the bug

In **v1.0.61**, the assistant's tool calls are intermittently rendered as **plain text in the chat transcript** instead of being executed. The leaked text is an `` block, consistently prefixed with a stray literal word **`course`**. When this happens the tool **does not run at all** — background agents are never started, shell/SQL/file tool calls never execute — and the user just sees raw markup.

Example of what appears in the chat (verbatim shape):

```
course

tester
...
background
...
...

```

### Observed pattern (high confidence, reproduced many times in one session)

- Happens **far more frequently after updating to 1.0.61**.
- Empirically: when the assistant's turn **begins with the tool call** (tool call is the very first content of the message), it executes reliably. When **narrative text precedes** the tool call in the same turn, the call tends to leak as text (with the `course` prefix) and is **not** executed.
- The leaked block is often **indented** (as if nested in a list/quote), and the leading token is consistently the word `course`.

### Impact

- Sub-agents / background tasks silently fail to start.
- Shell, SQL, and file-edit tool calls silently don't run.
- The user must notice the leak and re-prompt, repeatedly. Very disruptive for multi-step / agent-orchestration workflows.

### Expected behavior

Tool calls should always be parsed and executed regardless of any preceding narrative text in the same assistant turn. The literal `course` prefix should never appear.

### Environment

- GitHub Copilot CLI **1.0.61**
- OS: Windows
- Model: Claude Opus 4.8 (also observed while orchestrating custom sub-agents)

### Additional possibly-related observation

A separate input/rendering desync was also seen: the session indicated an **image attachment that the user did not actually send**. May share a root cause with the tool-call/text desync above.

报告中未确定任何文件或测试。在 Windows 上使用 Copilot CLI 1.0.61 重现该问题，比较工具调用在消息开头的轮次与包含前置叙述的轮次，并检查泄露的缩进 invoke 块和多余的“course”前缀所经过的解析/渲染路径。完成的标准是两种情况下工具调用都能执行，并且原始标记和前缀不再出现。

由索引模型根据 Issue 内容生成。