feat(memory,skills): approve/deny gate for memory + skill writes (#38199)

Adds memory.write_mode and skills.write_mode (on|off|approve), applied to
both foreground turns and the background self-improvement review fork — the
source of the unprompted 'wrong assumption' saves users reported.

- on (default): write freely, unchanged behaviour
- off: never write; the tool returns a clean disabled result
- approve: don't commit. Memory foreground writes prompt inline (small,
  reviewable in a chat bubble); background memory writes and ALL skill writes
  stage to a pending store instead (a SKILL.md is too large to review inline,
  and a daemon thread can't block on a prompt)

Review staged writes from CLI or any messaging platform:
  /memory pending|approve|reject|mode
  /skills pending|approve|reject|diff|mode

Skill review respects the size asymmetry: inline you see a one-line gist;
the full unified diff stays out-of-band (/skills diff, dashboard, or the
staged JSON file).

New: tools/write_approval.py (gate + pending store), hermes_cli/
write_approval_commands.py (shared CLI+gateway handlers). Gates wired at the
single entry points memory_tool() and skill_manage(), using the existing
write-origin ContextVar to distinguish foreground from background_review.

hermes_cli/config.py

@@ -1653,6 +1653,18 @@ DEFAULT_CONFIG = {
     "memory": {
         "memory_enabled": True,
         "user_profile_enabled": True,
+        # Write gate for the memory tool (add/replace/remove), applied to BOTH
+        # foreground agent turns and the background self-improvement review fork
+        # (the source of unprompted "wrong assumption" saves users reported):
+        #   on      — write freely (default, current behaviour)
+        #   off     — never write; the memory tool returns a clean disabled result
+        #   approve — foreground writes block on an inline approve/deny prompt
+        #             (entries are small enough to review in a chat bubble);
+        #             background-review writes are staged for review instead of
+        #             committed (a daemon thread cannot block on a prompt).
+        #             Pending entries: /memory pending, /memory approve <id>,
+        #             /memory reject <id>.
+        "write_mode": "on",
         "memory_char_limit": 2200,   # ~800 tokens at 2.75 chars/token
         "user_char_limit": 1375,     # ~500 tokens at 2.75 chars/token
         # External memory provider plugin (empty = built-in only).
@@ -1757,6 +1769,17 @@ DEFAULT_CONFIG = {
         # External hub installs (trusted/community sources) are always
         # scanned regardless of this setting.
         "guard_agent_created": False,
+        # Write gate for skill_manage (create/edit/patch/write_file/delete/
+        # remove_file), applied to BOTH foreground agent turns and the
+        # background self-improvement review fork:
+        #   on      — write freely (default, current behaviour)
+        #   off     — never write; skill_manage returns a clean disabled result
+        #   approve — stage the write for review instead of committing.
+        #             Pending skills are listed with /skills pending, reviewed
+        #             with /skills diff <id> (full diff — CLI/dashboard/file,
+        #             never crammed into a chat bubble), and applied with
+        #             /skills approve <id> or dropped with /skills reject <id>.
+        "write_mode": "on",
     },
 
     # Curator — background skill maintenance.