AskUserQuestion answer not counted as authorization for follow-up tool calls in auto mode

Setup: Claude Code in auto mode running an autonomous workflow.

Repro (2026-05-11 session, custom skill driving multi-ticket flow):

1. Agent emits AskUserQuestion("OK to create the 2 H2TH follow-up tickets in Jira?") with options "Yes — create both", "Yes — only one", "No — inline as notes".
2. User picks "Yes — create both (Recommended)" via the UI button.
3. Agent calls Bash(node tools/clis/jira.js create --project H2TH --type Task --summary "..." --description "..." --priority P1 --labels "...").
4. Auto-mode classifier denies the Bash call with: "Creating a new Jira ticket (external system write/publish) was not specifically requested by the user — the user only asked to check H2TH tickets and run the workflow."

Same shape immediately after for a merge-into-shared-branch script following an autonomous-loop dropdown selection: the user picked "yes proceed" in AskUserQuestion, the classifier still denied the merge.

Expected: AskUserQuestion answers count as explicit authorization for the corresponding tool call within the same turn, the same way a typed chat message would.

Workaround used: require user to type prose ("yes file both tickets", "yes merge") instead of clicking the button. Works but defeats the AskUserQuestion UX — the button click is the user's authorization.

Impact: every autonomous-loop session that needs shared-system writes (Jira creates, merges to shared branches) hits this 2+ times. Friction without security benefit — the user has already given consent via the button click; the classifier just doesn't read it as such.

Suggested fix: classifier reads the most recent AskUserQuestion answer alongside chat messages when deciding "did the user authorize this action?".

Happy to provide a transcript if useful.