fix: strip skill XML from session auto-naming

[isWittHere]

Fix

该修复让自动截取的session标题避免包含skill内容的XML块

A new session whose first message is a /skill: invocation stores the
SDK-expanded <skill> block as the message, so the no-name fallback
(firstMessage.slice(0, 50)) leaked raw XML into the sidebar session
title and the rename input.

Behavior

• The sidebar title of an unnamed skill-invoked session now shows
  /skill:name args instead of the expanded <skill> XML block.
• The rename input seeds from the same collapsed form, so an untouched
  rename stays a no-op instead of persisting the raw XML as the session
  name.
• Plain first messages and already-named sessions are unaffected.

Implementation

• Collapse via the existing skillExpansionToCommand helper in
  lib/slash-display.ts (the same one MessageView uses) before the
  50-char slice.
• Two call sites in components/SessionSidebar.tsx (title + rename
  initial value), ~15 lines.
• Two new tests in lib/slash-display.test.mjs.

Testing

• node_modules/.bin/tsc --noEmit — pass
• npx eslint components/SessionSidebar.tsx lib/slash-display.test.mjs — pass
• node --experimental-strip-types --test lib/slash-display.test.mjs — 7/7 pass