fix(approval): harden YOLO mode env parsing against quoted-bool strings

[teknium1]

Salvage of #16339 by @hharry11 onto current main.

Summary

HERMES_YOLO_MODE=false (or 0/off/no) now correctly disables YOLO instead of bypassing dangerous-command approval — previously bool(os.getenv(...)) on any non-empty string evaluated truthy.

Changes

• tools/approval.py: both read sites use shared is_truthy_value() helper
• cli.py + tui_gateway/server.py: YOLO toggle state detection matches the same semantics
• Regression tests for false-like strings in approval path, combined guard, and TUI gateway process-scope toggle

Validation

• E2E: YOLO=false bypass confirmed on current main → blocked on this branch; YOLO=1 still bypasses (no regression)
• 296/296 tests pass across tests/tools/test_yolo_mode.py, tests/test_tui_gateway_server.py, tests/tools/test_command_guards.py, tests/tools/test_hardline_blocklist.py

Closes #16339.