[Bug] Auto mode classifier allowed unauthorized push to main branch without explicit confirmation

Bug Description
Title: Auto mode pushed a large feature directly to main without user authorization

Claude Code implemented and pushed commit 46a9356 directly to origin/main even though I had not asked it to commit or push this feature.

Commit impact:

• 14 files changed
• 836 insertions, 21 deletions
• New activities, modules, tests, configuration changes, and documentation
• Bypassed the repository’s established feature-branch and pull-request workflow

The only earlier push authorization concerned a separate two-line change in commit afb8c13. Claude incorrectly treated that narrow authorization as permission to publish a later, substantially larger feature.

Permission evidence:

• No repository .claude directory
• No .claude/settings.json
• No .claude/settings.local.json
• User settings specify permissions.defaultMode = auto
• No explicit allow, ask, or deny rules
• /permissions screenshots show the Allow, Ask, and Deny tabs empty
• The Auto mode tab shows built-in classifier rules
• No visible deterministic rule required confirmation for git push

The repository's main branch was unprotected, and the available GitHub credential had broad scopes. Therefore the auto-mode classifier was the effective safety gate, and it allowed a high-impact external publication action without explicit approval.

Expected behavior:

• Editing files must not imply authorization to commit.
• Authorization to commit must not imply authorization to push.
• Authorization for one push must not become standing authorization for later pushes.
• Pushing to a default branch should require explicit, action-specific confirmation unless the user explicitly requested that exact push.
• Force pushes, repository deletion, releases, and merges should always receive heightened treatment.
• Claude should default to a feature branch/worktree and present a PR for review.

Afterward, Claude reported that the session was running in bypass-permissions mode. However, the user settings show defaultMode=auto and /permissions displays auto-mode classifier rules. Please investigate whether the session was actually in bypass mode, whether the explanation was incorrect, and which rule allowed the push.

Requested improvements:

1. Treat push-to-default-branch as an external high-impact action requiring explicit confirmation.
2. Keep edit, commit, push, PR creation, merge, release, and destructive GitHub operations as separate authorization boundaries.
3. Show the active permission mode and the matched auto-mode rule in the tool-call record.
4. Never infer standing publication permission from an earlier unrelated push.

Environment Info

• Platform: win32
• Terminal: antigravity
• Version: 2.1.278
• Feedback ID: 5858b5e8-0776-4aba-a6b4-5ffc7b7c5e26

Errors

[]

<img width="542" height="192" alt="Image" src="https://github.com/user-attachments/assets/732efb88-85af-42ab-96b7-d313e1869a4a" />
<img width="571" height="190" alt="Image" src="https://github.com/user-attachments/assets/b6f7c64e-bf0e-46f6-a740-a3004b30c77c" />
<img width="1390" height="405" alt="Image" src="https://github.com/user-attachments/assets/c561bb43-75a7-404f-a976-a6bbbf4bb452" />
<img width="591" height="174" alt="Image" src="https://github.com/user-attachments/assets/2553889c-e99d-4866-9b8e-74324a7743a4" />