fix(approval): wake blocked gateway approvals on session cleanup

[Yukipukii1]

Summary

• wake blocked gateway approval waiters during session-boundary cleanup
• mark cleared approvals as denied so old runs unwind immediately
• add regression coverage for both direct approval cleanup and gateway boundary cleanup

Why

clear_session() removed pending gateway approval queues without signaling the blocked waiter events. When /new, /resume, or /branch cleaned session state while a dangerous-command approval was pending, the old run could remain blocked until the approval timeout expired.

Testing

• tests/gateway/test_approve_deny_commands.py
• tests/gateway/test_session_boundary_security_state.py

Result:

• 25 passed

[teknium1]

Merged via #18171. Your commit was cherry-picked onto current main with authorship preserved in git log (commit 5f3f456). Thanks @Yukipukii1!