fix(approval): gate perl/ruby -i in-place edits of Hermes config/env

[AhmetArif0]

Summary

sed -i coverage for ~/.hermes/config.yaml and .env was added in #14639, but perl -i and ruby -i — which perform the same direct file mutation — were not covered. The existing perl/ruby pattern only catches -e/-c (code evaluation), not -i (file mutation), leaving this bypass open:

perl -i -pe 's/approvals.mode: on/approvals.mode: off/' ~/.hermes/config.yaml

config.yaml is the security policy (approvals.mode, yolo, and the permanent-approval allowlist live there). The mtime-keyed config cache reloads it mid-session, so a successful write immediately disables the gate — identical threat model to the sed -i gap that #14639 closed.

Changes

• tools/approval.py: adds one pattern — \b(?:perl|ruby)\s+-[^\s]*i against both _HERMES_CONFIG_PATH and _HERMES_ENV_PATH, directly mirroring the sed -i lines
• tests/tools/test_approval.py: three new tests in TestHermesConfigWriteProtection — perl -i on config.yaml, ruby -i on config.yaml, perl -i on .env

Test plan

• uv run --frozen python -m pytest tests/tools/test_approval.py -x -q — 200 passed (197 existing + 3 new)
• perl -i and ruby -i against ~/.hermes/config.yaml are now flagged as dangerous
• perl -e / perl -c (code execution) and cat ~/.hermes/config.yaml (read) still behave correctly — no false positives introduced

[teknium1]

Merged via PR #38998. Your commit was cherry-picked onto current main with your authorship preserved in git log (commit a6a4e6f). Added a follow-up commit that widens the regex to also catch the separate-token form (perl -p -i -e config.yaml), which the first-flag-token pattern missed. Thanks for closing this bypass class.