feat(workflows): add user-defined slash command macros

[sincera7]

Summary

• adds a first-class slash_command workflow trigger for exact bare commands
• exposes the matched name and argument tail as {{trigger.command}} and {{trigger.args}}
• preserves @Agent /command as ACP pass-through
• adds Desktop workflow-form authoring, validation, labels, icons, and template-variable discovery
• refreshes the bundled buzz-cli skill so managed agents can create, update, remove, and collision-check macros from natural-language requests

Closes #6785.

Example

name: New task
trigger:
  on: slash_command
  command: new-task
steps:
  - id: plan
    action: send_message
    text: "@Planner /plan {{trigger.args}}"
    reply_in_thread: true
  - id: review
    action: send_message
    text: "@Reviewer /review {{trigger.args}}"
    reply_in_thread: true

/new-task Build feature XYZ runs the workflow with trigger.args = Build feature XYZ. /new-task-extra does not match, and @Hermes /new-task ... remains an agent-runtime command.

Design notes

No new event kind or execution path is introduced. The trigger reuses stored kind-9 messages, the existing workflow engine, existing action authorization, loop suppression, and buzz workflows create/update/delete CLI.

This does not weaken ACP author policy. Default owner-only wake behavior for workflow-generated agent mentions remains tracked independently in #3858 and its competing fix PRs. Composer autocomplete is likewise separate (#2528, #5700, #6567).

Verification

• cargo test -p buzz-workflow — 176 passed, 2 Postgres-only ignored
• cargo clippy -p buzz-workflow --all-targets -- -D warnings
• cargo check -p buzz-relay
• pnpm --dir desktop test — 5,456 passed
• pnpm --dir desktop typecheck
• focused workflow UI tests — 46 passed
• just desktop-check
• just fmt-check
• just file-size-check
• bundled skill validated with the OpenAI skill validator

Environment-limited checks:

• Desktop Tauri Rust tests cannot compile on this host because GTK/GObject development packages are absent.
• Repository-wide just check-compile reaches an unrelated OpenSSL native dependency and stops because openssl.pc is absent. The narrower relay and workflow compile checks pass.