chore(approval): tighten allow_permanent comments + DRY the no-always opt set

Collapse the verbose multi-line rationale comments across the TUI/desktop/
backend approval surfaces into single-line "why" notes, and derive
APPROVAL_OPTS_NO_ALWAYS from APPROVAL_OPTS instead of re-listing it.
No behavior change.

ui-tui/src/app/createGatewayEventHandler.ts

@@ -728,8 +728,7 @@ export function createGatewayEventHandler(ctx: GatewayEventHandlerContext): (ev:
         return
       case 'approval.request': {
         const description = String(ev.payload.description ?? 'dangerous command')
-        // Backend omits the field for the common case; only an explicit false
-        // (tirith warning present) drops the permanent-allow option.
+        // Only an explicit false (tirith warning) drops the permanent-allow option.
         const allowPermanent = ev.payload.allow_permanent !== false
 
         patchOverlayState({

ui-tui/src/components/prompts.tsx

@@ -8,10 +8,8 @@ import type { ApprovalReq, ClarifyReq, ConfirmReq } from '../types.js'
 import { TextInput } from './textInput.js'
 
 const APPROVAL_OPTS = ['once', 'session', 'always', 'deny'] as const
-// When the backend disallows a permanent allow (tirith content-security
-// warning present) the "always" option is dropped — picking it would only
-// be silently downgraded to session scope, so don't offer it.
-const APPROVAL_OPTS_NO_ALWAYS = ['once', 'session', 'deny'] as const
+// tirith warning present → backend downgrades "always" to session scope, so drop it.
+const APPROVAL_OPTS_NO_ALWAYS = APPROVAL_OPTS.filter(o => o !== 'always')
 const LABELS = { always: 'Always allow', deny: 'Deny', once: 'Allow once', session: 'Allow this session' } as const
 const CMD_PREVIEW_LINES = 10
 
@@ -34,7 +32,7 @@ type ApprovalAction = { kind: 'choose'; choice: ApprovalChoice } | { kind: 'move
  *
  * Esc and number keys both terminate the prompt; Esc maps to deny (parity
  * with the global Ctrl+C handler that already calls cancelOverlayFromCtrlC
- * for approvals).  Numbers 1..OPTS.length pick the labelled choice.  Enter
+ * for approvals).  Numbers 1..opts.length pick the labelled choice.  Enter
  * confirms the current selection.  ↑/↓ moves the selection within bounds.
  */
 export function approvalAction(

ui-tui/src/types.ts

@@ -90,8 +90,7 @@ export interface DelegationStatus {
 }
 
 export interface ApprovalReq {
-  // When false the backend will not honor a permanent allow (e.g. a tirith
-  // content-security warning is present), so the prompt hides "Always allow".
+  // false when the backend won't honor a permanent allow (tirith warning) → hide "Always allow".
   allowPermanent?: boolean
   command: string
   description: string