[BUG] Opus 4.8 refusal on benign code-audit prompt — false positive Usage Policy block

Description
Claude Code v2.1.161 on darwin, Opus 4.8 (1M context), emits stop_reason: \"refusal\" and the harness converts it to \API Error: invalid_request\ on an extremely benign prompt.

Trigger prompt (verbatim):
\"quiero que hagas una auditoria de la app\"
(Spanish: \"I want you to do an audit of the app\")

Error shown in terminal:
\\\
API Error: Claude Code is unable to respond to this request, which appears to violate
our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc
to edit your last message or start a new session for Claude Code to assist with a
different task.
Request ID: req_011Cbh1LSycqrYUiTBoJdZLC
\\\

Environment:

• Model: claude-opus-4-8 (1M context)
• Claude Code: v2.1.161
• Effort level: xhigh
• Platform: darwin (macOS)
• Session had prior context about opening a local Flask web app (no security tools, no exploit code)

Observed behavior (from log analysis):

1. \stop_reason: \"refusal\"\ fires at 21:05:54 on the prompt above
2. Harness immediately converts to \isApiErrorMessage: true\ / \invalid_request\ at 21:05:55
3. Error message shown to user does NOT include the CVP form link (it was absent)
4. Retry cascade triggered — multiple \invalid_request\ events on same requestId

Confirmed workaround:
\/model claude-sonnet-4-6\ processes the same prompt in the same session context without any refusal. Opus 4.8 triggers; Sonnet 4.6 does not.

Request:
a) Fix classifier: \"auditoria de la app\" / code audit prompts with zero exploit content should not trigger the cyber content filter
b) Include CVP form link in the error message when cyber filter fires (it was absent here)

Related: #50162 #49679 #59540