Exempt `~/.claude/jobs/**` (fork/background job scratch) from the protected-path guard, like `.claude/worktrees`

Summary

Forked sessions (/fork, --fork-session) and background jobs write ephemeral scratch to ~/.claude/jobs/<id>/tmp/…. Because the protected-path guard matches .claude by directory name (with no project-vs-home distinction), any model tool call that reads or edits these harness-created scratch files hits the protected-path prompt — repeatedly, once per access.

This is the same category of path that already has carve-outs: .claude/worktrees is explicitly exempted "where Claude stores its own git worktrees," and .claude/commands, .claude/agents, .claude/skills were exempted because Claude routinely writes there. ~/.claude/jobs/** is pure ephemeral scratch created by the harness itself — arguably an even safer exemption, since nothing under it is configuration the model could use to escalate its own permissions.

Request: add .claude/jobs/** (the fork/background job scratch tree) to the protected-path exemption list, alongside .claude/worktrees.

Why the existing mitigations don't apply

• permissions.allow rules such as Edit(~/.claude/jobs/**) do not suppress it — the protected-path safety check runs before settings allow rules are evaluated (documented behavior, and confirmed in #66525).
• The per-session "allow Claude to edit its own settings for this session" option is per-session only (and reported unreliable in #66525).
• bypassPermissions works but is far broader than intended and is restricted to isolated containers/VMs.
• auto mode routes these to the classifier, which is a workaround but requires an eligible plan/model and adds classifier round-trips for what is zero-risk local scratch.

Expected vs actual

• Expected: reads/edits of ~/.claude/jobs/<id>/tmp/… proceed without a protected-path prompt, the same way .claude/worktrees writes do.
• Actual: every such access prompts in default/acceptEdits/plan mode.

Environment

• Claude Code (current), observed during /fork sessions.
• Reproducible on Windows and expected on all platforms (the guard is name-based).

Related (closed) issues — same guard, different subpaths

#66525 (.claude/ edits prompt in acceptEdits; allow rules + per-session option don't suppress), #51571 (.claude/skills/ exemption misses the Edit tool), #37253 (~/.claude/ prompts under bypass — closed as by-design). Those were closed as "not planned" because they argued for weakening the guard broadly; this request is the narrow, precedent-backed alternative: exempt one ephemeral scratch subtree, not the config root.