fix: omit undefined V2 command prompt fields

[danyel117]

Summary

• omit absent files, agents, and skills fields when V2 slash commands forward prompts
• filter any other top-level prompt fields whose values are explicitly undefined, while preserving defined future fields
• keep present attachment arrays and strip command mention metadata as before
• exercise both omitted-array and present-array command payloads in the native V2 smoke test

Root cause

The command executor always materialized files, agents, and skills on context.session.prompt, even when their values were undefined. OpenCode V2 beta-19129 rejects those present-but-undefined array fields with SchemaError, so /goal, /pause_goal, and /resume_goal could return HTTP 500 before a model call.

Verification

• bun run lint
• bun run typecheck
• bun test — 249 passed
• bun run build
• bun run pack:dry-run
• isolated native OpenCode V2 v0.0.0-beta-19129 smoke with local fixture model and state: PASS
  • /goal with attachment arrays omitted creates and completes a goal
  • /goal with empty attachment arrays creates state for its exact second session

Claude Opus audits

• Round 1: two medium findings — sanitize future undefined fields and retain arrays-present E2E coverage; both corrected.
• Round 2: one medium finding — ensure the arrays-present smoke observes execution; corrected.
• Round 3 final: one medium finding — make that observation attributable to the exact second session rather than a global model-call counter; corrected with a per-session state assertion. Per policy, no fourth audit was requested.
• Final known high/medium findings after corrections and the repeated gates: none.

Closes #47

AI assistance: implemented with OpenAI Codex (GPT-5) and audited with Claude Code using Opus.