fix(approval): close gateway lifecycle bypass gaps (fixes #33071)

[zccyman]

Summary

Fixes #33071

Problem

The dangerous-command approval gate protected hermes gateway restart but allowed equivalent effects through bypass paths:

Bypass	Command	Detection status
pkill -f pattern	pkill -f 'hermes.*gateway'	❌ Not covered
pkill -f unquoted	pkill -f hermes_cli	❌ Not covered
pkill -f unquoted	pkill -f gateway_run	❌ Not covered
pidof substitution	kill $(pidof hermes_cli.main)	❌ Not covered
pidof substitution	kill $(pidof gateway)	❌ Not covered
systemctl --user	systemctl --user stop hermes-gateway	❌ Not covered
launchctl	launchctl stop ai.hermes.gateway	❌ Not covered
launchctl kickstart -k	launchctl kickstart -k gui/$(id -u)/ai.hermes.gateway	❌ Not covered

Fix

Added 8 new patterns to HARDLINE_PATTERNS in tools/approval.py:

pkill -f hermes_cli         → "kill hermes/gateway by command-line pattern"
kill $(pidof hermes_cli.main) → "kill process via pidof expansion"
systemctl --user stop hermes-gateway → "stop/restart hermes systemd service"
launchctl stop ai.hermes.gateway → "stop/restart hermes launchd service"

Read-only commands remain unblocked:

• systemctl --user status hermes-gateway
• launchctl print gui/.../ai.hermes.gateway
• pgrep -f hermes

Scope note

Direct kill -TERM <pid> where the agent obtains the PID via ps/pgrep and passes a concrete number is not capturable by regex (the PID itself is opaque to pattern matching). Full mitigation requires transport-level or API-level guard — tracked in #32877.

Testing

• 191 approval tests pass (184 existing + 7 new)
• 8 new test cases cover each bypass path + false-positive guards

[teknium1]

Closing as a duplicate of #33084, which was merged via #53216 (commit 3c8d3ec). Both PRs fixed the same #33071 vectors (pidof expansion + launchctl); we went with #33084 as the cleaner implementation. Thanks for the fix, @zccyman — credited on the issue.