fix(mobile): restore #9128's slash-command position gate

Adversarial review of the batch-1 resolutions caught two defects in my own work.

#9128 has three hunks in mobile's composer command menu. I took two and dropped
the third: provider slash commands must only be offered when the trigger opens
the message, because a provider expands `/foo` only in that position and
otherwise receives it as literal text. `rangeStart` is the line start, so a
`/foo` typed on any later line was still offering provider commands on mobile.
Web already gates this through `slashCommandItemsForPromptPosition`, so the two
clients had silently diverged.

Also adds `0x4bs3nt` and `Adamulek123`, two of the six contributors #9131
vouched. Resolving that conflict with `checkout --ours` discarded every name
that existed only on upstream's side; I had misread the merged file's context
lines as Pylon-side content and only re-added four.

Author: rynfar

.github/VOUCHED.td

@@ -9,6 +9,8 @@
 #   -github:username reason for denouncement
 #
 # Keep entries sorted alphabetically.
+github:0x4bs3nt
+github:Adamulek123
 github:adityavardhansharma
 github:binbandit
 github:chuks-qua

apps/mobile/src/features/threads/use-composer-command-menu.ts

@@ -126,11 +126,15 @@ export function buildComposerCommandItems({
       true,
     );
 
+    // A provider expands a slash command only when it opens the whole message;
+    // elsewhere it arrives as literal text. `rangeStart` is the line start, so
+    // a `/foo` typed on a later line must not offer provider commands.
     const providerCommands: ComposerCommandItem[] = [];
-    for (const cmd of getProviderSlashCommandsForSlashMenu(
-      providerSlashCommands,
-      slashMenuSkills,
-    )) {
+    const expandableCommands =
+      trigger.rangeStart === 0
+        ? getProviderSlashCommandsForSlashMenu(providerSlashCommands, slashMenuSkills)
+        : [];
+    for (const cmd of expandableCommands) {
       if (!cmd.name.toLowerCase().includes(q)) continue;
       // Codex `/feedback` uploads an existing thread's session and logs, so it
       // has nothing to send before the thread exists.