Add dashboard integrity/watchdog console

Surface integrity and watchdog state in the read-only dashboard via a new
/api/integrity endpoint and integrity_report(): watchdog/heartbeat
verdict, FIM baseline and package-DB anchor freshness, pacman keyring and
SigLevel posture, and Sentinel's own self-integrity footprint. The
endpoint summarizes existing anchors and heartbeats only — it runs no live
FIM or package verification from the request path, keeping the dashboard
read-only.

Add the enodia.integrity.v1 schema (schemas.py + docs/SCHEMAS.md) with a
contract test, a new "Integrity" dashboard tab and summary metric, and
web tests for the report shape, schema contract, endpoint, and console
wiring. Docs updated; completes the v1.0 "dashboard to local console"
roadmap item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -50,10 +50,11 @@ Implemented investigation/response state:
 - Incident tracking groups snapshots by process lineage and time window and
   exposes `incident list/show/export`.
 - The dashboard is HTTPS-only, token-protected off loopback, and read-only. It
-  shows status, incidents, timelines, alerts, posture findings, event-rule
-  metadata, event tail, dry-run response plans, and a local Settings menu with
-  persistent themes. Web tests cover the theme registry and core text/status
-  contrast checks.
+  shows status, incidents, timelines, alerts, posture findings,
+  integrity/watchdog state, event-rule metadata, event tail, dry-run response
+  plans, and a local Settings menu with persistent themes. Web tests cover the
+  theme registry, integrity console wiring, and core text/status contrast
+  checks.
 - `respond plan <incident-id>` builds read-only containment/recovery plans,
   persists CLI-generated plans under `response-plans/`, and appends
   `response-audit.log`. Dashboard/API plan previews do not write artifacts.