Summary

Fixes #1617.

• Key approval denials by a canonical argument hash for file-write tools, shell/task-shell tools, and generic approval-gated tools, so a denial only suppresses exact retries instead of every future call of the same tool.
• Keep approve-for-session behavior tool-wide while making deny auto-cache match only the approval key.
• Omit trailing commas from the canonical argument serialization after review feedback, with a regression test for the exact serialized shape.
• Remove two Windows-only needless returns in ui.rs so the repository clippy command passes with warnings denied.

Root cause

PR #1388 stopped inserting tool_name into approval_session_denied, but most tools still built fallback approval keys as tool:<tool_name>. For tools like edit_file, write_file, and task_shell_start, denying one request therefore cached a key reused by later distinct requests. The UI path also still accepted legacy tool-name deny hits.

Testing

• cargo test --all-features
  • Ran after the latest commit on this Windows checkout; failed with 3052 passed, 5 failed, 3 ignored.
  • The failing tests are outside this approval-cache change:
    • session_manager::tests::latest_session_for_workspace_ignores_newer_other_directory and session_manager::tests::latest_session_for_workspace_ignores_invalid_parent_git_marker also fail individually here. This checkout has C:\.git\HEAD, so the temp workspaces are detected as sharing the same parent git root.
    • commands::change::tests::change_in_non_english_without_api_key_uses_explicit_fallback also fails individually in this environment.
    • tools::pandoc::tests::pandoc_convert_roundtrips_markdown_to_html_inline and tools::pandoc::tests::pandoc_convert_writes_output_path_and_reports_summary failed during the full run with pandoc: getXdgDirectory:sHGetFolderPath: illegal operation, but both passed when rerun individually.
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo build
• cargo test -p deepseek-tui approval_cache
• cargo test -p deepseek-tui session_denied_cache_matches_only_approval_key
• cargo test -p deepseek-tui session_approved_cache_keeps_tool_name_session_grants

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• Verified TUI behavior manually if UI changes
  • Covered by focused unit tests; no manual interactive TUI session was run.