Report the resolved definition path (and content hash) for each custom agent

Look for where custom agents are loaded and the session.custom_agents_updated event is emitted. The code likely resides in the agent resolution logic, possibly in a file like src/agent/loader.js or similar. Start by searching for 'custom_agents_updated' and 'tools_available' in the codebase. Understand how agent definitions are resolved from multiple sources (repo, user, plugin, --add-dir). Add the absolute file path and a SHA-256 hash of the file content to the agent entry. Verify the change by running the CLI with a custom agent and checking the debug log or event output.

Describe the feature or problem you'd like to solve

session.custom_agents_updated reports source: "project" for an agent, but not which file it came from. When several definitions could supply an agent ID (repo, user, plugin, --add-dir), the caller can't confirm which one actually loaded. Nor can it confirm that the loaded file is the one it reviewed. This matters for teams that review agent definitions before trusting an automated run.

Proposed solution

Add the resolved definition's absolute path and a content hash (for example, SHA-256) to each agent entry in session.custom_agents_updated. The same data could go in the debug log next to tools_available.

Example prompts or workflows

A pipeline runs copilot --agent implementer -p .... Before trusting the run, it checks that implementer resolved to .github/agents/implementer.agent.md with the reviewed hash. If a same-ID definition elsewhere took precedence, the pipeline refuses the run.

Additional context

Copilot CLI 1.0.87-0, Windows. The only read-back we have today is tools_available. It shows what an agent was offered, but not why.