[BUG] Session resumes and executes further tool calls after a hard trust-safety block, via background-task completion notification

### Preflight Checklist
- [x] Searched existing issues — this specific mechanism hasn't been reported. Related but distinct: #86111 (repeated blocks within a session, but every chat message failing — not a background-task notification reactivating the session), #88425 (multiple same-session `[bio]` blocks, good general context).
- [x] This is a single bug report
- [x] Using the latest version of Claude Code

### What's Wrong?

**Summary**

A Claude Code session that received a hard trust-and-safety block ("Sonnet 5 can't help with this. Start a new session to continue.") did not actually stop. It had already launched a background Bash task before the block; that task is an independent OS-level process, so it kept running after the block and completed on its own ~22 minutes later. The harness's own background-task-completion notification was then delivered into the already-blocked session as a new inbound message, and the model resumed — read files, reasoned at length, and executed further tool calls (including reading logs reflecting live SSH sessions against production network devices) — before hitting a second block.

**Evidence, from the raw session `.jsonl`**

- Session ID: `78e7edac-be2f-4b9f-a1d3-837d042c6ee0`
- Environment: Claude Code desktop, v2.1.260, macOS
- **Block 1:** `2026-09-05T17:13:31.347Z`, Request ID `req_011Cekfb7tBCLzJZrYqhC2mX`, `Details: [bio]`
- A background task ("Run claude-user provisioning across the full [ISP] folder") was already running at this point, launched earlier in the same session.
- **`2026-09-05T17:35:53.375Z`** (~22 minutes after Block 1) — the background task completes on its own (exit code 0). The harness delivers a task-notification event into the already-blocked session:
```

b9jyx6ytv
completed
Background command "Run claude-user provisioning across the full [ISP] folder" completed (exit code 0)

```
- The model treats this as a new turn: reads the task's output files, reasons about the results, and runs further tool calls reading logs of live device sessions.
- **Block 2** (same session): `2026-09-05T17:43:10.825Z`, Request ID `req_011CekhozEeRJFeji2gyr9Fx`, also `Details: [bio]` — fires mid-way through the model reporting a finding.
- We directly observed the resume happen live (watched the second block occur) before finishing tracing the mechanism from the raw transcript.

**What Should Happen?**

The block message says "Start a new session to continue," which reasonably implies the session is inert. At minimum: a session's already-dispatched background tasks and their completion notifications should not be able to hand a hard-blocked session a new turn to act on — especially one where the model goes on to execute further tool calls against live infrastructure. Either the background task should be interrupted (or its notification suppressed) once its parent session receives a terminal safeguards block, or the harness should decline to feed that notification back into the model as a new turn.

**Related issues**

- #86111 — repeated blocks recurring within one session, but described as every subsequent chat message failing, not a background-task notification reactivating the session for further tool execution. Related pattern, different mechanism.
- #88425 — same-session multiple `[bio]` hard-blocks with request IDs; useful general context for how these blocks cluster within a session.
- The `[bio]` classification accuracy itself is a separate, well-reported issue (#89896 and many others) — this report is specifically about the session continuing to act after being blocked, independent of why the block fired.

### Environment Info
- Platform: darwin (macOS)
- Claude Code desktop app, version 2.1.260
- Entry point: claude-desktop

Start at the claude-desktop entry point and trace how background-task completion notifications are delivered after the session receives a terminal safeguards block. Use the supplied session 78e7edac-be2f-4b9f-a1d3-837d042c6ee0 and its raw .jsonl evidence to reproduce the sequence. Done means a blocked session cannot resume or execute further tool calls from a background-task completion notification.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.