claude code appends a role:"system" block after the user prompt, so a proxy rewriting the trailing user message is a no-op.