test(approval): cover approval orchestration paths

[wgu9]

Summary

• Add behavior tests for approval session/yolo state, gateway queue resolution, and session cleanup.
• Cover approval config fallback/persistence helpers and callback fail-closed behavior.
• Cover check_dangerous_command orchestration for containers, hardline blocks, cron handling, gateway approval payloads, and CLI deny/session/always choices.

Coverage

• tools/approval.py: 57% -> 72% in the targeted coverage run.

Tests

• scripts/run_tests.sh tests/tools/test_approval.py
• .venv/bin/python -m pytest tests/tools/test_approval.py --cov=tools.approval --cov-report=term-missing
• .venv/bin/ruff check tests/tools/test_approval.py

Closes #36523

[wgu9]

Rebased this on current main and resolved the import conflict in tests/tools/test_approval.py by keeping both upstream approval-mode helpers and this PR's cron/yolo/gateway coverage helpers.

Validation:

• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python -m pytest tests/tools/test_approval.py -q -> 318 passed
• python -m ruff check tests/tools/test_approval.py
• python -m py_compile tests/tools/test_approval.py
• git diff --check upstream/main...HEAD

[teknium1]

Thanks for adding focused approval coverage. One assertion needs updating for current main.

Problems

• tests/tools/test_approval.py:321 expects _await_gateway_decision() to return exactly two keys. Current main returns {"resolved": ..., "choice": ..., "reason": ...} at tools/approval.py:2556 (the reason field came from cb6c47af08), so this test would fail after salvage.

Suggested changes

• Assert the required fields individually at tests/tools/test_approval.py:321—resolved and choice—and optionally assert reason is None, rather than asserting the entire return dict.

Automated hermes-sweeper review.

[wgu9]

Rebased onto current main. The gateway-decision assertion now checks resolved, choice, and reason individually, matching the current return contract. The 20 tests added by this PR pass, and git diff --check upstream/main...HEAD passes. The full approval test file has one unrelated existing macOS /tmp path-classification failure; all 331 other tests pass.