feat(providers): link command mentions to backing files where no native channel exists

[chuks-qua]

What

Command mentions now carry an optional path end to end: contract schema, composer insert sites, persistence, and provider mappers. Composer display and stored transcript text stay /name / @name unchanged.

Per provider, native channels stay native; the [/name](path) link is emitted only where the provider would otherwise get inert text:

• Codex: structured {"type":"skill", name, path} input parts, client-side prompts: expansion, and plugin:// mention parts are unchanged. When a command mention's capabilityIdentity no longer resolves in the catalog (skill removed or renamed between pick and send), the text becomes [/name](path) args so the agent can locate the file itself.
• Cursor: command/skill mentions rewrite to [/name](path) via rewriteCursorCommandMentionsAsLinks, using original mention ranges (multi-mention safe); pathless or stale mentions pass through unchanged. The injected catalog now carries backing paths.
• Devin, Claude, Copilot: unchanged, their native resolution is kept.

Verified: web slash-command tests (60), Codex provider first-turn tests (50), mention schema and Cursor prompt suites. Live on fixture-repo: a /adhd composer pick reached Codex as a native skill part plus $adhd text and the skill ran; a crafted stale-identity mention arrived as [/e2e-link-probe](C:\...\SKILL.md) args text and the agent read the linked file itself.

Why

Slash-command delivery depended on each provider noticing a bare /name in prompt text. On ACP-backed flows (Devin, Codex) that silently misses, leaving the agent with an unexplained token and no file to act on. A Markdown link to the backing SKILL.md makes the invocation self-describing exactly where no native channel exists, without downgrading the providers that already resolve commands natively.

UI Changes

No visual change: the composer still renders /name chips and persists /name text. Screenshots show the live verification run: the /adhd mention in the composer and the sent message with the skill chip while the Codex turn executes.

Config Changes

None.

Review Notes

• Path is optional on command mentions and validated like other mention paths (bounded, control characters rejected).
• Cursor live execution was not verifiable in this environment (cursor-agent CLI not installed); the rewrite is unit-tested including multi-mention offsets and stale-range passthrough.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}