[security] fix(api-server): scope run approvals by run id

[teknium1]

Summary

API-server /v1/runs dangerous-command approval queues are now scoped by the generated run_id, so one API run can no longer resolve another run's pending approval.

Root cause: the approval queue key was gateway_session_key or session_id or run_id. session_id is caller-controllable continuity metadata that concurrent runs can intentionally share, so two runs with the same session_id shared one approval queue — and resolve_all=true on one run drained the other run's pending dangerous-command approval.

Changes

• gateway/platforms/api_server.py: approval_session_key = run_id (was gateway_session_key or session_id or run_id). The two read sites (/v1/runs/{run_id}/approval, stream sweeper) already pull the stored key from _run_approval_sessions[run_id], so they inherit the fix.
• tests/gateway/test_api_server_runs.py: regression — two runs with the same session_id, separate pending approvals, resolve_all=true on the attacker run resolves exactly one and leaves the victim entry untouched.

session_id / X-Hermes-Session-Key remain the conversation/memory scope. once / session / always / deny all preserved, now scoped to the target run.

Validation

	Before	After
resolve_all=true on attacker run	drains shared queue → resolved: 2, victim unblocked	drains only target run → resolved: 1, victim untouched

• scripts/run_tests.sh tests/gateway/test_api_server_runs.py -q → 23/23 pass
• E2E: real resolve_gateway_approval(run_id, resolve_all=True) against two seeded queues — attacker queue drained, victim's pending approval event stays unset.

Salvaged from #24212 by @Hinotoi-agent; commit re-anchored to current main (original diff was rooted at an older revision), authorship preserved.

Infographic

[alt-glitch]

This was generated by AI during triage.

Salvage of #24212 by @Hinotoi-agent (commit re-anchored to current main, authorship preserved) -> related, not duplicate. Same api-server run-scoping family as #42459 (session-key scoping) and #45888 (Responses-path approval wiring).