Subagent unable to post inline PR comments due to Bash tool security restrictions

I've written a subagent prompt/definition and I want it to carry out a PR review in a certain style etc. I'm struggling to figure out how to get it to have the right permissions to use the `gh api` trick to make an inline code comment, or to use the inbuilt CC action's own internal MCP server which has a tool for making these code comments.

**Context**
I'm using the `claude-code-action@v1` to run a custom "reviewer" subagent on pull requests. The goal is for this subagent to analyze the code and post inline review comments for specific issues it finds.

- **Trigger:** The workflow is triggered by a comment on a PR (e.g., `@claude stefan-review`).
- **Agent:** A main agent receives the request and then uses the `Task` tool to invoke a specialized `stefan-reviewer` subagent.
- **Goal:** The subagent should post line-specific comments using the GitHub API.

**Problem**
The subagent is consistently unable to post inline comments. All attempts to do so via the `Bash` tool are blocked by the tool's security sandbox in the non-interactive GitHub Actions environment. The agent gets stuck in a loop, trying different methods, all of which fail for security reasons.

Here is a summary of the approaches we've tried, based on the agent's behavior seen in the logs.

-----

### **Attempt 1: Direct `gh api` Call**

The initial approach was to instruct the agent to use `gh api` directly.

- **Command:**
```bash
gh api /repos/{owner}/{repo}/pulls/{pr}/comments --method POST -f body="..." ...
```
- **Why it Failed:**
1. **Backtick Interpretation:** The `Bash` tool's guard interprets backticks (` ` ` ) within the Markdown `body`as unsafe command substitution, causing an error:`Command contains backticks (\`) for command substitution\`.
2. **Permission Denial:** Even when the agent reformats the command to avoid backticks, the command is blocked with: `This Bash command contains multiple operations. The following parts require approval: gh api --method POST, ...`. The sandbox seems to treat any `POST` request as a sensitive operation requiring interactive approval.

-----

### **Attempt 2: Wrapper Shell Script**

To work around the complex arguments, we created a wrapper script (`.github/scripts/post_inline_comment.sh`) and allow-listed it with `Bash(.github/scripts/post_inline_comment.sh*)`.

- **Command:**
```bash
./.github/scripts/post_inline_comment.sh --path "..." --body "Multi-line comment..." ...
```
- **Why it Failed:**
- The agent's attempt to call the script with a long, multi-line `--body` string was still flagged as a "complex command" that required approval, leading to the same permission denial error.

-----

### **Attempt 3: Wrapper Script with Stdin (`echo "..." | ./script`)**

To simplify the command-line arguments, we modified the script to read the comment body from `stdin`.

- **Command:**
```bash
echo "Multi-line comment..." | ./.github/scripts/post_inline_comment.sh --path "..." ...
```
- **Why it Failed:**
- The security sandbox also blocks shell operators. The use of the pipe (`|`) and heredocs (`<<'EOF'`) was flagged with: `This command uses shell operators that require approval for safety`.

-----

### **The Recommended (but still failing) Approach: Built-in MCP Tool**

The correct solution *should* be to use the action's built-in MCP server for posting inline comments. We configured our workflow as follows:

1. **Updated `.github/workflows/claude-reviewer.yml`:** We added the `github_inline_comment` server to the `mcp-config` and updated `allowedTools` to include `mcp__github_inline_comment__create_inline_comment`.
2. **Updated `.claude/agents/stefan-reviewer.md`:** We instructed the agent to use the `mcp__github_inline_comment__create_inline_comment` tool directly and removed all references to `gh api` and the wrapper script.

Despite these changes, the agent's behavior in the latest logs indicates that it is **still not using the MCP tool**. It immediately reverts to trying the failing `gh api` and `Bash` script methods from previous attempts. This suggests the subagent may not be discovering or prioritizing the available MCP tool correctly.

**Request for Guidance**

1. What is the canonical, recommended way for a **subagent** (invoked via the `Task` tool) to post inline PR comments in a non-interactive CI environment?
2. Is there a known reason why a subagent might not see or use an MCP tool (`mcp__...`) that has been correctly configured and allow-listed in the workflow's `claude_args`? Does the MCP server context propagate to subagents?
3. Is there any workaround to get the `Bash` tool to permit a specific `gh api POST` command without triggering the security sandbox for multi-line bodies or shell operators?

It seems the `Bash` tool is fundamentally not designed for this kind of API interaction in CI. The MCP tool approach feels correct, but we're stuck trying to get the agent to actually use it. Any advice would be greatly appreciated.