fix(tui_gateway): register shell hooks at desktop/TUI startup

[liuhao1024]

What does this PR do?

Registers declarative shell hooks (config.yaml hooks: entries) at TUI/desktop startup, fixing a security gap where pre_tool_call blocking hooks were silently ignored in the desktop app.

Related Issue

Fixes #43823

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• tui_gateway/entry.py: Added register_from_config(load_config(), accept_hooks=False) call in main(), wrapped in try/except to never block TUI startup. Matches the existing pattern in gateway/run.py:4500-4508.
• tests/tui_gateway/test_shell_hooks_registration.py: Added 2 tests — (1) register_from_config is called with accept_hooks=False, (2) registration failure does not block startup.

How to Test

1. Add a shell hook to config.yaml:

   hooks:
     pre_tool_call:
       - matcher: "terminal"
         command: "echo blocked"
         timeout: 5
   hooks_auto_accept: true

2. Start hermes --tui, send a prompt that triggers a terminal tool call.
3. Verify the hook fires (check agent.log for "shell hook" entries).
4. Without this fix, the hook is silently skipped in the desktop/TUI.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

• Analyzed: tui_gateway/entry.py::main() — entry point for desktop/TUI JSON-RPC server
• Blast radius: LOW — adds a single registration call with exception guard; no existing behavior changed
• Related patterns: entry-point parity gap (cli.py:943, gateway/run.py:4502 both call register_from_config; tui_gateway was the missing surface)

[alt-glitch]

Duplicate of #13854 — same fix (register shell hooks at tui_gateway startup). #13854 is the earliest open canonical; competing #34112/#41464; #43828 is an identical same-batch twin. Fixes #43823.

[liuhao1024]

Closing in favor of #13854 by @witt3rd, which is the earliest open canonical fix for the same issue (register shell hooks at tui_gateway startup). #13854 has a more structured implementation (+108 lines, extracted _register_shell_hooks() function + 2 regression tests).

Both PRs address the same security gap: pre_tool_call blocking hooks from config.yaml hooks: are silently ignored in Desktop/TUI sessions because register_from_config() was never called in tui_gateway/entry.py::main().