[BUG] Image markdown is silently rewritten in GitHub comments posted from cloud sessions

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

When Claude posts a GitHub issue or PR comment from a Claude Code on the web cloud session, every image embed in the body is rewritten before it reaches GitHub:

| Sent | Stored by GitHub |
| --- | --- |
| `` | `[alt](url)` — leading `!` stripped, becomes a plain link |
| `[](target)` | `[[alt](url)](target)` — `!` stripped, leaves a broken nested link |
| `` | `` `<img src="url" width="300">` `` — HTML-escaped and wrapped in a code span |

**This happens silently.** The API call returns `201 Created`, the tool result reports success, and nothing in the response indicates the body was modified. It is only detectable by reading the comment back and diffing it against what was sent.

Note that this is not about uploading images to github, but rather linking images uploaded to other places (cloudflare R2 in my case) in github comments.

### What Should Happen?

Image markdown should be passed through unmodified. If this is intentional behavior then this should be clarified in some way, better to throw an error and let users know that image markdown is not allowed and at the very least document it somewhere.

However I would argue if this sanitation is specifically designed to prevent embedding images in markdown then it is overzealous - having the agent add images to PRs is essential for fast PR reviews and to my knowledge there is no serious threat model where showing images would result in malicious behaviors for visitors or where showing images that were already uploaded somewhere else would expand malicious extraction of information (I.E. the agent already uploaded the images somewhere else, linking to it in github is not going to increase the threat)

### Error Messages/Logs

```shell

```

### Steps to Reproduce

From a Claude Code on the web cloud session, against any repository you can comment on:

1. Post a comment containing an image embed:

```sh
gh api repos/OWNER/REPO/issues/1/comments \
-f body=''
```

2. Read back what GitHub actually stored:

```sh
gh api repos/OWNER/REPO/issues/1/comments --jq '.[-1].body'
```

3. Compare:

```
Expected: 
Actual: [icon](https://claude.ai/images/claude_app_icon.png)
```

The `` variant, for completeness:

```sh
gh api repos/OWNER/REPO/issues/1/comments \
-f body=''
```

```
Expected:
Actual: `<img src="https://claude.ai/images/claude_app_icon.png" width="200">`
```

Both also reproduce via the GitHub MCP server's `add_issue_comment` tool with the same body, producing byte-identical output.

### Claude Model

Opus

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.243

### Platform

Anthropic API

### Operating System

Other

### Terminal/Shell

Other

### Additional Information

_No response_

No repository files or tests are named. Reproduce the behavior with the supplied gh api commands, compare the sent and stored bodies, then trace the cloud-session GitHub comment path and the MCP add_issue_comment entry point; done when image markdown is preserved or the behavior is explicitly rejected and documented.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.