fix(desktop): replay pending approvals after reconnect

[konsisumer]

What changed and why

Per the reporter's clarification on 2026-08-05, a Desktop approval can remain queued after its original WebSocket delivery is lost. session.resume and session.activate now return the oldest unresolved approval using the existing session-scoped approval queue. Desktop restores that prompt only after its runtime session is bound, so the existing approval controls can respond normally without re-running the tool or extending the timeout.

Addressing maintainer feedback

• feat(chat): keep-alive + reattach for dashboard terminal sessions (#50084 salvage) #60515 delivered Dashboard PTY reattach and replay. This PR addresses the remaining Desktop half called out in the maintainer comment: a pending Desktop approval is now recoverable after reconnect.

How to test

• Start a Desktop session that reaches a dangerous-command approval.
• Disconnect and reconnect the Desktop gateway, then resume the same session.
• Confirm the original approval controls return and approving or denying resolves the original blocked operation once.
• Automated: pytest tests/tui_gateway/test_protocol.py -q -x --timeout=60 (43 passed).
• Automated: pytest tests/tools/test_approval.py::TestApprovalTimeoutIsNotConsent -q -x --timeout=60 (4 passed).
• The required full-suite command was attempted but stops at the unrelated existing tests/tools/test_approval.py::TestDetectDangerousRm::test_nonrecursive_verification_artifact_cleanup_is_not_dangerous assertion.

What platforms tested on

• Platform-independent Python gateway protocol tests.
• Desktop TypeScript typecheck was not run because apps/desktop/node_modules is unavailable in this worker environment; no manual Desktop run was performed.

Refs #53839