chore(approval): tighten allow_permanent comments + DRY the no-always opt set

Collapse the verbose multi-line rationale comments across the TUI/desktop/
backend approval surfaces into single-line "why" notes, and derive
APPROVAL_OPTS_NO_ALWAYS from APPROVAL_OPTS instead of re-listing it.
No behavior change.

tools/approval.py

@@ -1428,12 +1428,8 @@ def check_all_command_guards(command: str, env_type: str,
                 "pattern_key": primary_key,
                 "pattern_keys": all_keys,
                 "description": combined_desc,
-                # Mirror the CLI's allow_permanent gate (see prompt_dangerous_approval
-                # below). When a tirith content-security warning is present the
-                # backend silently downgrades an "always" choice to session scope
-                # (see the persistence loop after the decision), so the UI must not
-                # offer a permanent allow it can't honor. Without this field the
-                # TUI/desktop always render "Always allow".
+                # Mirror the CLI's allow_permanent gate: a tirith warning downgrades
+                # "always" to session scope below, so the UI must not offer it.
                 "allow_permanent": not has_tirith,
             }
             decision = _await_gateway_decision(