[BUG] Custom remote MCP connector - all tools show "Auto-Allow disabled by your admin" in routine, despite org-wide Always Allow

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Environment

Plan: Enterprise
Surface: Claude Code → Routines → routine detail (connector panel)
Connector: custom remote MCP server (org-managed, added via Organization settings > Connectors)

Observed
Every tool on a custom remote MCP connector shows "Auto-Allow disabled by your admin" in the routine's connector panel, and the routine cannot auto-approve them during unattended runs. This occurs despite all org admin settings being fully permissive:

- Org Settings > Connectors > [connector]: default restriction for unconfigured tools = Always allow; all tools "Uses default"
- Org Settings > Cowork > Permissions: "Allow 'Always allow' for connector tools" = on
- Org Settings > Claude Code > Managed settings: empty
- Routines: enabled

Expected
Per the routines docs, connector tools should run in unattended cloud sessions without approval prompts.

Notable / relation to closed issues:

- #61097 was closed as addressed but scoped its fix to Anthropic-hosted connectors (Gmail/Workspace/Notion), explicitly stating custom remote MCP connectors were unaffected. We are seeing the same class of failure on a custom remote MCP connector, which suggests either a regression or that the custom-connector path was never covered.

- #56757 (closed) reports the same "Always allow ignored" symptom.

Impact
Custom-connector routines are unusable for auto-publish/scheduled workflows; the documented core value of autonomous cloud execution with connectors does not hold for custom connectors.

Request
Confirm whether the custom-connector routine path is covered by the #61097 fix, and if not, treat this as the custom-connector variant.

### What Should Happen?

Setting auto-allow should be honored

### Error Messages/Logs

```shell

```

### Steps to Reproduce

Via claude:

Environment: Claude Code [X.Y.Z], macOS [version], Team plan.
Nine connectors are enabled for the workspace, including an
org-managed internal connector ("Connector A") and several
third-party ones. The workspace admin has disabled Auto-Allow on a
subset of tools across more than one connector.

1. Go to Routines > New routine. Scroll to the Connectors section
   (shown by default — no tab switching needed). A banner reads:

     "Claude can use all unrestricted tools from these connectors —
      including writes — without asking for permission during runs."

   and immediately below, in the same banner:

     "Your admin restricts some tools in these connectors:"

   followed by a list of tools each marked "Auto-Allow disabled by
   your admin". The two halves contradict each other, and neither
   states what happens at runtime when a restricted tool is needed.

Scope note: this banner appears only for cloud routines, not local
ones. The same connector and tool set works in a local session,
where a human can approve the prompt.

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

N/A - Cowork

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

_No response_

Start by reproducing the issue in Claude Code → Routines with an org-managed custom remote MCP connector and the stated Always Allow settings. Compare the behavior with closed issues #61097 and #56757. Done means custom-connector tools honor the configured auto-allow setting during unattended runs, without the contradictory restriction banner.

Written by the indexing model from the issue text.