Agent host: a slash command is never executed when the turn carries host context

### Summary

In the agent chat, a slash command is offered by completion and submits normally, but is never executed. The model receives the raw text and answers from its own knowledge, so it reads as the command being missing rather than broken.

### Cause

The prompt composer returns the user's text as the first content block and then appends host-composed context after it: attachment representations, read-only snapshot notes, and the reference reminder. The Claude CLI only treats a message as a slash command when its content is a **single** text block. Any turn carrying context therefore silently stops being a command.

### Reproduction

Run against the SDK the host spawns, same session and options, varying only the shape of `message.content`:

| `content` | result |
|---|---|
| `"/list-agents"` (string) | expands: `No subagents, teammates or other Claude sessions.` |
| `"/list-agents\n\n..."` (string) | expands |
| `[{type:"text",text:"/list-agents"}]` | expands |
| `[{type:"text",text:"/list-agents\n\n..."}]` | expands |
| `[{type:"text",text:"/list-agents"},{type:"text",text:"..."}]` | **does not expand** |

In the failing case the model replies with invented prose, `No agents are currently running. You can spawn a new agent using the Agent tool...`, instead of the command's real output.

The discriminator is the **number of text blocks**, not the presence of context.

### Evidence from a real session

- The SDK's `system/init` message advertises 46 `slash_commands` including `code-review`, so discovery is correct and completion is right to offer it.
- A transcript entry for a real user message beginning `/code-review` records its `content` as an array of two text blocks, which is the failing shape above.
- An unknown command is reported explicitly by the CLI (`Unknown command: /nope`), so the failure is not a lookup miss. The message simply never reaches command handling.

### Impact

Every slash command in the agent chat is affected whenever the turn carries an attachment or context. Because completion still lists the command, it presents as the command not existing.

### Suggested fix

Merge the appended text blocks into the first when the message is a slash command. The table above shows a single text block with the context appended inline still expands, so no context has to be dropped, and non-text blocks such as images can follow unchanged.

*AI disclosure: this issue and the related investigation were written with the assistance of AI.*

### Public patches and patcher scripts

[Public patch catalog and patcher scripts](https://github.com/RyanEwen/vscode-patches/blob/main/CATALOG.md) · [Source patch index](https://github.com/RyanEwen/vscode-patches/blob/main/SOURCE-PATCHES.md). The [public collection](https://github.com/RyanEwen/vscode-patches) includes the maintained patchers, rollback instructions, regression scripts, and historical snapshots. Build restrictions and exact installer coverage are documented there.