#13537: Gateway: add commands.list slash command metadata API

#### Summary - add a new gateway RPC method `commands.list` to expose slash-command metadata for clients (including iOS) - wire the method into gateway method routing, read-scope authorization, and method listing - add focused tests for `commands.list` - keep this PR gateway-only (no protocol-schema/Swift model churn) #### Behavior Changes - clients can call `commands.list` with optional filters: `provider`, `sessionKey`, `includePlugins`, `includeSkills` - response includes normalized command metadata: `key`, `name`, `slash`, `description`, `scope`, `source`, optional `aliases`, `category`, `nativeName`, `acceptsArgs`, `args` - skill commands can be resolved per-session agent via `sessionKey` - plugin commands are included by default and can be excluded with `includePlugins=false` #### Tests - `pnpm check` - `pnpm exec vitest run src/gateway/server-methods/commands.test.ts src/gateway/protocol/index.test.ts` - `pnpm protocol:check` - `python3 scripts/analyze_code_files.py --compare-to origin/main --threshold 1000 --strict` Code word: lobster-biscuit **Sign-Off** - Models used: GPT-5 Codex - Submitter effort (self-reported): medium <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> Adds a new Gateway RPC method `commands.list` and wires it into the gateway handler map (`src/gateway/server-methods.ts`) plus the advertised method list (`src/gateway/server-methods-list.ts`) and read-scope authorization. The new handler (`src/gateway/server-methods/commands.ts`) returns normalized slash-command metadata derived from the existing commands registry, optionally including skill commands resolved per-session agent via `sessionKey`, and plugin commands (included by default, with `includePlugins=false` to exclude). Includes unit tests validating response shape, plugin inclusion toggles, session-based skill resolution, and invalid-param rejection. <h3>Confidence Score: 4/5</h3> - This PR is safe to merge with minimal risk. - Changes are additive and localized (new handler + routing/listing updates) and reuse existing command registries for data generation. I did not find any definite correctness or integration bugs in the new method implementation. Unable to execute the provided test commands in this environment due to missing pnpm, so confidence is slightly reduced. - src/gateway/server-methods/commands.ts <!-- greptile_other_comments_section --> _{(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!} <!-- /greptile_comment -->