skillOverrides: "off" does not block explicit slash command invocation

Bug Description

Setting a skill to "off" via skillOverrides in settings.local.json does not prevent the skill from running when explicitly invoked using a slash command (e.g. /hello-user).

Expected Behavior

A skill set to "off" should be completely disabled — it should not run regardless of how it is invoked, including explicit slash command invocation.

Actual Behavior

The "off" override correctly suppresses the skill from the model's available-skills list (auto-triggering based on description is blocked). However, when the user explicitly types /hello-user, the skill still executes.

Steps to Reproduce

1. Create a local skill, e.g. .claude/skills/hello-user/SKILL.md
2. Add to .claude/settings.local.json:

``json
{
"skillOverrides": {
"hello-user": "off"
}
}
``

1. In a Claude Code session, type /hello-user
2. The skill runs despite being disabled

Notes

The "off" flag appears to only gate the auto-trigger path (removing the skill from the injected available-skills context). The explicit slash command path (/<skill-name>) does not appear to check the override flag before executing.