simplify(compat): approval — drop 43 facade re-exports + _command_detection_variants late-bind seam, repoint 30 callers + 46 test files

tools/approval.py no longer re-exports sibling names (approval_context/prompt/floors/detection/
human_wait/smart/gateway_wait); it imports only what it uses. Siblings reference sibling-defined
names directly (module-attribute reads on tools.approval_context so patching the defining module
still works); only facade-owned state (_lock, _gateway_queues, _permanent_approved, _denied,
_denial_breaker_addendum, _gateway_notify_cb) is still read back through tools.approval.
approval_detection calls its own _command_detection_variants instead of late-binding through the facade.

tools/terminal_tool_sudo.py

@@ -180,7 +180,7 @@ def _prompt_for_sudo_password(timeout_seconds: int = 45) -> str:
     _sudo_cb = _get_sudo_password_callback()
     if _sudo_cb is not None:
         try:
-            from tools.approval import human_wait_window
+            from tools.approval_human_wait import human_wait_window
             with human_wait_window():
                 return _sudo_cb() or ""
         except Exception:
@@ -204,7 +204,7 @@ def _prompt_for_sudo_password(timeout_seconds: int = 45) -> str:
         print("  Password (hidden): ", end="", flush=True)
         password_thread = threading.Thread(target=_read_hidden_password, args=(result,), daemon=True)
         password_thread.start()
-        from tools.approval import human_wait_window
+        from tools.approval_human_wait import human_wait_window
         with human_wait_window():
             password_thread.join(timeout=timeout_seconds)
         if not result["done"]: