Add dashboard integrity/watchdog console

Surface integrity and watchdog state in the read-only dashboard via a new
/api/integrity endpoint and integrity_report(): watchdog/heartbeat
verdict, FIM baseline and package-DB anchor freshness, pacman keyring and
SigLevel posture, and Sentinel's own self-integrity footprint. The
endpoint summarizes existing anchors and heartbeats only — it runs no live
FIM or package verification from the request path, keeping the dashboard
read-only.

Add the enodia.integrity.v1 schema (schemas.py + docs/SCHEMAS.md) with a
contract test, a new "Integrity" dashboard tab and summary metric, and
web tests for the report shape, schema contract, endpoint, and console
wiring. Docs updated; completes the v1.0 "dashboard to local console"
roadmap item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_schema_contracts.py

@@ -178,6 +178,24 @@ class TestSchemaContracts(unittest.TestCase):
             "heartbeat_stale": bool,
         })
 
+    def test_integrity_v1_contract(self):
+        report = web.integrity_report(self.cfg, status={
+            "running": True,
+            "heartbeat_age": 1.0,
+            "heartbeat_stale": False,
+        })
+        self.assertEqual(report["schema"], schemas.INTEGRITY_V1)
+        _assert_types(self, report, {
+            "schema": str,
+            "generated_at": float,
+            "status": str,
+            "checks": dict,
+            "watchdog": dict,
+            "anchors": dict,
+            "sentinel_footprint": dict,
+            "read_only": bool,
+        })
+
     def test_response_plan_and_audit_contracts(self):
         iid = self._record_incident_with_snapshot()
         bundle = respond.load_bundle(self.cfg, iid)