Background subagents (e.g. via /code-review) silently auto-deny gated Bash commands instead of prompting

Summary

Since the v2.1.232 change ("Non-teammate agent spawns in interactive sessions now run in the background by default"), gated Bash commands executed inside a background subagent are silently auto-denied instead of surfacing an interactive permission prompt to the user. There is no queue, retry, or notification — the subagent just receives a denial and (in my case) silently degraded to a wrong result instead of failing loudly.

Reproduction

1. Running Claude Code 2.1.234 on Windows.
2. Ran /code-review 9953 to review a specific GitHub PR by number.
3. /code-review (background-by-default since v2.1.221) spawned a subagent to resolve and review the target.
4. The subagent correctly resolved PR 9953 via gh pr view 9953 (got the real title/branch back).
5. To get the PR's actual content, it ran git fetch origin refs/pull/9953/head:pr-9953 and git fetch origin main. Both are gated commands not in my allowlist.
6. Because the subagent runs in the background, these calls got the literal tool result "This command requires approval" immediately — no prompt ever reached me, and there was no way to approve them.
7. With every fetch path blocked, the subagent fell back to reviewing an unrelated local branch's diff and returned a full, confident-looking code review for the wrong changes entirely — with nothing indicating the fetches had failed.

Why this matters

• This is effectively silent privilege downgrade with no user-visible signal: normal foreground usage prompts for git fetch; the exact same command inside a backgrounded subagent just fails closed with no way to grant it, and the calling flow doesn't surface that failure to the user either.
• I want to keep a strict "always ask" permission posture (no blanket allowlisting), but that posture is currently incompatible with any skill/command that spawns background subagents (e.g. /code-review), since those subagents structurally cannot ask.
• The only workaround I've found is CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1, which disables all backgrounding (fire-and-forget agents, Ctrl+B, concurrent review agents, long-running background Bash), not just the permission-prompt gap. That's a much blunter fix than the actual problem calls for.
• This looks related to the already-closed #36042 ("Background sub-agents silently blocked by permission prompts"), closed "not planned," but it's now hitting a first-party bundled command (/code-review), not just custom MCP tool usage, which raises the stakes.

Suggested fixes (any of these would help)

• Surface a queued/async permission prompt for background subagent tool calls, so approving mid-run is possible instead of only pre-launch prediction.
• At minimum, make the auto-deny result loud: have the calling skill/agent detect "requires approval" denials and report to the user that the review is incomplete/degraded, rather than silently substituting a different target.
• Let CLAUDE_CODE_DISABLE_BACKGROUND_TASKS (or a new, narrower setting) apply only to permission-gated calls, so foreground-prompting can be preserved without losing backgrounding entirely.

Environment

• Claude Code 2.1.234
• Windows 11, Git Bash
• Permission mode: default (no allowlist for git fetch/gh)