[Bug] Inappropriate content flagging for authorized system administration tasks

**Bug Description**
I was again knocked off of fable to Opus 4.8 because Fable was going to connect to one of lab machines and pull some crash logs. It labeled it as "cyber". However, I am supposed to have reduced retsrictions while working on Caesar linux per my application which was approved.

**Environment Info**
- Platform: linux
- Terminal: gnome-terminal
- Version: 2.1.268
- Feedback ID: b8056bf6-5464-4297-b5ac-c1f12b54bb13

**Errors**
```json
[]
```

Start with the report and Feedback ID b8056bf6-5464-4297-b5ac-c1f12b54bb13, then reproduce the authorized crash-log retrieval on Linux in GNOME Terminal. Trace where the system-administration task is labeled "cyber"; done means this authorized workflow is not inappropriately flagged while other safety checks remain effective.

Written by the indexing model from the issue text.