rm-on-variable-path confirmation dialog fires under bypassPermissions with no way to disable/detect it, freezing unattended background agents for hours

## Summary

The "Dangerous rm operation on possibly-empty variable path" confirmation dialog fires **even under `bypassPermissions` mode**, and cannot be suppressed by any `permissions.allow` rule or `PreToolUse` hook returning `allow`. In an unattended multi-agent setup (background teammate sessions spawned via the `Agent`/`Task` tool, running with no one watching the terminal), this silently freezes the teammate's pane until a human happens to notice and click through it.

## Impact

Running Claude Code with background/teammate agents (the documented Agent-team pattern), a teammate that emits any `rm -r`/`rm -rf` command touching a shell-variable path stalls indefinitely — not for seconds, but until a human physically clicks "yes" in that pane's terminal. Measured on our end: one teammate sat frozen for ~13 hours, another for ~8 hours more shortly after, both fully idle, silently waiting on a dialog nobody knew existed until we happened to check the pane directly.

This is a severe usability regression for any workflow that relies on `bypassPermissions` specifically *because* it promises unattended execution. If a check is going to override `bypassPermissions`, it needs a way to be silenced (e.g., an explicit opt-out flag/env var), or at minimum it needs to be observable from outside the frozen pane (surfaced to the spawning session, or logged somewhere pollable) so an orchestrating process can detect and handle it instead of a human being the only possible unblock path.

## Reproduction

Any of the following patterns raise the confirmation, even in `bypassPermissions` mode:
- `rm -rf "$T"` (quoted variable path)
- `rm -rf "$TMP/x"`
- `trap 'rm -rf "$TMP"' EXIT`
- Confirmed to also fire on non-rm content that merely *contains the literal text* `rm -r` near a `$var`-shaped path — e.g. a `grep` pattern string like `'rm -rf\|rm -r '` followed by a `"$D/$s.jsonl"`-style path in the same Bash call raised the same dialog, with no `rm` actually being executed.

## What we've verified

- Per Claude Code's own docs (`https://code.claude.com/docs/en/permission-modes.md`, sections "Skip all checks with bypassPermissions mode" and "Critical paths"): `rm`/`rmdir` removals targeting a "critical path" still prompt in `bypassPermissions`, and no `permissions.allow` rule or `PreToolUse` hook returning `allow` can approve it.
- No environment variable, CLI flag, settings key, or hook we could find disables this specific check.
- The check appears to be a **textual/pattern scan on the submitted command text**, not a semantic check of what the command actually does — see the grep-pattern false-positive above.

## Ask

Either:
1. An explicit, documented opt-out (env var or settings flag) for this specific check, scoped narrowly enough that it doesn't reopen the broader "critical path" protections `bypassPermissions` already carves out exceptions for, or
2. A way for an orchestrating/parent session to be notified when a spawned teammate is blocked on this dialog, so it can be handled programmatically instead of requiring a human to physically be at the keyboard.

Happy to provide more reproduction detail if useful.

Start with the permission-modes.md documentation and reproduce the reported rm variable-path cases under bypassPermissions, including the grep-pattern false positive. Trace the permission handling for the Agent/Task background-session entry points and determine whether the result should be a narrowly scoped opt-out or parent-session notification; done means unattended agents no longer remain silently blocked and the behavior is covered by a reproducible test.

索引モデルが issue の本文から書いたものです。