fix(tui): approval nav lockups, shell non-diff preview, hint dedup

Three QA-found issues in the approval gate:

- displayState gated the in-session/approval surfaces on hasApproval
  before sessionEntered, so moving the list cursor onto a session with a
  pending gate auto-opened it, and `l` back-to-list couldn't escape
  (the gate re-popped). Require sessionEntered first.
- The band ran every preview through the two-column diff renderer, so a
  shell tool's argv JSON rendered as an identical-column "diff". Detect
  real unified diffs (isUnifiedDiff); render other previews as plain
  text, and drop the ^x fullscreen hint when there's nothing to expand.
- The footer duplicated the band's approve/reject/steer/diff keys. It now
  shows navigation (l back / e events / q quit) instead.

apps/tui-go/internal/app/demo.go

@@ -84,6 +84,25 @@ func PreviewFrame(kind string, w, h int) string {
 			}
 		}
 
+	case "approval-shell":
+		m.connected = true
+		m.currentModel = "llama-cpp:default"
+		m.sessions = sampleSessions()
+		m.selectedID = "04a546aa"
+		m.sessionEntered = true
+		if s := m.session("04a546aa"); s != nil {
+			s.CurrentStage = "execute_script"
+			s.Events = sampleEvents()
+			s.Pending = &Approval{
+				RequestID: "req-2", SessionID: "04a546aa", Tier: "T2", Risk: "MEDIUM",
+				ToolName: "shell",
+				Preview:  `{"argv":["bash","scripts/healthcheck.sh"]}`,
+				Rationale: []string{
+					"[INTERPRETER_EXECUTION] Tool 'shell' invokes interpreter 'bash'",
+				},
+			}
+		}
+
 	case "diff":
 		m.connected = true
 		m.currentModel = "llama-cpp:default"