fix: scope terminal approval exemptions

[trac3r00]

Summary

• allow only strict read-only active-profile config inspection commands through terminal approval
• allow only single-target recursive cleanup under the current Kanban task workspace
• preserve hardline, sensitive-write, and ambiguous-command protections; clarify that a denied destructive action does not block read-only discovery

Verification

• python -m pytest tests/tools/test_approval.py -q -o "addopts=" -k "KanbanWorkspaceRecursiveCleanup or ReadOnlyProfileConfigInspection or ApprovalTimeoutIsNotConsent"
• python -m pytest tests/tools/test_tirith_security.py -q -o "addopts="
• python -m pytest tests/agent/test_tool_guardrails.py -q -o "addopts="
• python -m py_compile tools/approval.py

Known baseline: the full tests/tools/test_approval.py run has one pre-existing macOS tempdir canonicalization failure in test_nonrecursive_verification_artifact_cleanup; this PR does not touch that path.

[teknium1]

Thanks for narrowing the proposed command shapes and adding negative cases. The recursive-cleanup exemption needs one safety boundary before it can be salvaged.

Problems

• tools/approval.py:2009 treats every descendant of HERMES_KANBAN_WORKSPACE as disposable. Kanban explicitly supports preserved dir: and worktree workspaces (website/docs/user-guide/features/kanban.md:66-68), so this would auto-allow recursive deletion inside a user source tree. Existing Kanban cleanup deliberately refuses paths outside managed scratch roots (tests/hermes_cli/test_kanban_db.py:2535-2563).
• The new cleanup tests exercise detect_dangerous_command, not the terminal gate that executes the full policy ordering (tools/approval.py:3335).

Suggested changes

• Gate the exemption on verified managed-scratch containment/workspace kind, rather than the task workspace environment variable alone.
• Add check_all_command_guards coverage for scratch versus preserved workspaces and for a matching approvals.deny rule.

Automated hermes-sweeper review.

[teknium1]

HERMES_KANBAN_WORKSPACE is also used for preserved dir: and worktree tasks, not just disposable scratch tasks (website/docs/user-guide/features/kanban.md:66-68). A descendant-only check would auto-allow rm -rf inside a user source tree. Please require the same managed-scratch containment/workspace-kind proof used by Kanban's automatic cleanup.