Auto mode can hold locally auto-allowed shell commands for a server-side classifier

In auto mode, Claude Code can now take a shell command that local rules had already allowed and turn it back into a question. The shown reason is "Auto mode held this command for the server-side classifier to review". A classifier here is a check run on Anthropic's servers that decides whether a command looks safe. Before this change, a command allowed by those local rules simply ran.

This happens only when all of these are true:

• The original allow came from the sandbox rule (the sandbox is a restricted environment commands run inside) or from the read-only rule (commands that only look at things and change nothing).
• The call is not a served call.
• The auto-mode classifier mode is arbiter or arbiterWithLocalFallback.

The held request records which local rule it overrode in a reroutedFrom field, set to sandbox or readOnly. For commands made of several parts, a new helper looks through each part's result to find the rule that produced the allow.