MC-4655

Bug reported by Elmar via Telegram bug topic. Issue: When Luci creates MC tickets from Telegram, Hermes sometimes asks for command approval even though the user expects YOLO / always-allowed mode to bypass this. Observed trigger: a ticket-creation terminal command was paused by a security scan because the description included a raw Tailscale IP URL. This created an extra permission prompt during a routine ticket creation flow. Expected: Routine MC ticket creation from the bug-report topic should not require an extra approval prompt. If YOLO / always-allowed is enabled for the session, the approval layer should honor it consistently, or the workflow should avoid terminal-command patterns that trigger the security scanner. Acceptance criteria: - Inspect Hermes approval mode behavior for Telegram gateway sessions versus CLI YOLO / always-allowed settings. - Determine whether raw-IP URL detection is bypassing or ignoring YOLO / always-allowed. - Fix or route MC ticket creation through a safer API/helper that avoids shell security prompts. - Verify a bug-topic report can create a ticket without asking Elmar for permission. Expected check-in: today + 2h