chore(approval): tighten allow_permanent comments + DRY the no-always opt set

Collapse the verbose multi-line rationale comments across the TUI/desktop/
backend approval surfaces into single-line "why" notes, and derive
APPROVAL_OPTS_NO_ALWAYS from APPROVAL_OPTS instead of re-listing it.
No behavior change.

apps/desktop/src/components/assistant-ui/tool-approval.tsx

@@ -61,9 +61,7 @@ const ApprovalBar: FC<{ request: ApprovalRequest }> = ({ request }) => {
   // it goes through a confirm step rather than firing straight from the menu.
   const [confirmAlways, setConfirmAlways] = useState(false)
   const busy = submitting !== null
-  // The backend drops the permanent-allow path when a tirith content-security
-  // warning is present (it would silently degrade "always" → session scope), so
-  // don't offer the option. Only an explicit false hides it.
+  // false when the backend won't honor a permanent allow (tirith warning) → hide "Always allow".
   const allowPermanent = request.allowPermanent !== false
 
   const respond = useCallback(