chore(approval): tighten allow_permanent comments + DRY the no-always opt set

Collapse the verbose multi-line rationale comments across the TUI/desktop/
backend approval surfaces into single-line "why" notes, and derive
APPROVAL_OPTS_NO_ALWAYS from APPROVAL_OPTS instead of re-listing it.
No behavior change.

apps/desktop/src/app/session/hooks/use-message-stream.ts

@@ -933,8 +933,7 @@ export function useMessageStream({
         // raise it and wait — the sidebar flags "needs input" and the inline bar
         // surfaces once the user focuses that chat.
         setApprovalRequest({
-          // Only an explicit false (tirith content-security warning) drops the
-          // permanent-allow option; the backend omits the field otherwise.
+          // false only when a tirith warning forbids it; backend omits the field otherwise.
           allowPermanent: payload?.allow_permanent !== false,
           command: typeof payload?.command === 'string' ? payload.command : '',
           description: typeof payload?.description === 'string' ? payload.description : 'dangerous command',

apps/desktop/src/components/assistant-ui/tool-approval.tsx

@@ -61,9 +61,7 @@ const ApprovalBar: FC<{ request: ApprovalRequest }> = ({ request }) => {
   // it goes through a confirm step rather than firing straight from the menu.
   const [confirmAlways, setConfirmAlways] = useState(false)
   const busy = submitting !== null
-  // The backend drops the permanent-allow path when a tirith content-security
-  // warning is present (it would silently degrade "always" → session scope), so
-  // don't offer the option. Only an explicit false hides it.
+  // false when the backend won't honor a permanent allow (tirith warning) → hide "Always allow".
   const allowPermanent = request.allowPermanent !== false
 
   const respond = useCallback(

apps/desktop/src/store/prompts.ts

@@ -68,9 +68,7 @@ function keyedPromptStore<T extends KeyedPrompt>(): PromptStore<T> {
 // resolved via approval.respond {choice, session_id}). It carries no request_id,
 // unlike sudo/secret which are _block()-style request/response.
 export interface ApprovalRequest extends KeyedPrompt {
-  // Only an explicit false hides "Always allow" — set when the backend will not
-  // honor a permanent allow (a tirith content-security warning is present), so
-  // the bar doesn't offer a choice that silently degrades to session scope.
+  // false when the backend won't honor a permanent allow (tirith warning) → hide "Always allow".
   allowPermanent?: boolean
   command: string
   description: string