chore(approval): tighten allow_permanent comments + DRY the no-always opt set

Collapse the verbose multi-line rationale comments across the TUI/desktop/
backend approval surfaces into single-line "why" notes, and derive
APPROVAL_OPTS_NO_ALWAYS from APPROVAL_OPTS instead of re-listing it.
No behavior change.

ui-tui/src/types.ts

@@ -90,8 +90,7 @@ export interface DelegationStatus {
 }
 
 export interface ApprovalReq {
-  // When false the backend will not honor a permanent allow (e.g. a tirith
-  // content-security warning is present), so the prompt hides "Always allow".
+  // false when the backend won't honor a permanent allow (tirith warning) → hide "Always allow".
   allowPermanent?: boolean
   command: string
   description: string