feat(gui): add optional tkinter and Qt6 desktop dashboards

Add two optional windowed frontends over the same local state the TUI and
web console read: `enodia-sentinel gui` (stdlib tkinter) and
`enodia-sentinel gui-qt` (PySide6, new `[qt]` extra).

Both share `gui/model.py`, a GUI-free presentation model over
`tui.collect_model`, so every formatter is unit-testable without a display
server. Only `app.py` and `qt_app.py` import GUI libraries, enforced by
import-guard tests mirroring the tray applet's boundary.

Tabs cover status, alerts, incidents, posture, integrity, response plans,
and the event tail, plus daemon-control buttons via systemctl. Response
plans are display-only; the GUIs never execute containment commands. Core
runtime dependencies stay empty.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JX86xeoBJVBb16qHkDf53K

docs/COMMAND_REFERENCE.md

@@ -431,6 +431,34 @@ Command mode supports `status`, `alerts`, `incidents`, `timeline`, `posture`,
 `back`, `refresh`,
 `filter <text>`, `clear`, and `quit`.
 
+### `gui` / `enodia-sentinel-gui`
+
+```bash
+enodia-sentinel gui
+enodia-sentinel-gui
+```
+
+Opens the stdlib tkinter desktop dashboard. It reads the same local state as
+the TUI and web console (daemon status, alerts, incidents, posture, integrity,
+events, and read-only response plans) and adds a toolbar for daemon control:
+start, stop, restart, quick check, open dashboard, and refresh.
+
+Requires a working `tkinter` installation (usually the distro
+`python-tk`/`python-tkinter` package); the core agent itself has no runtime
+dependencies. Response plans are displayed for review only — the GUI does not
+execute commands.
+
+### `gui-qt` / `enodia-sentinel-gui-qt`
+
+```bash
+enodia-sentinel gui-qt
+enodia-sentinel-gui-qt
+```
+
+Opens the optional Qt6 desktop dashboard. It shows the same read-only tabs and
+daemon controls as the tkinter GUI with a native look, resizable columns, and
+a response-plan detail pane. Requires the `[qt]` extra (`PySide6`).
+
 ### `web`
 
 ```bash

docs/OPERATIONS.md

@@ -91,6 +91,15 @@ use directly, so daemon start/stop/restart prompts for polkit authorization as
 usual. The applet is purely a convenience frontend — it is not required for the
 daemon to run and adds nothing to the core agent.
 
+A windowed desktop GUI (`enodia-sentinel gui` / `enodia-sentinel-gui`) is also
+available using only stdlib `tkinter`. It shows the same read-only tabs as the
+TUI plus daemon-control buttons, and like the tray applet it is optional and
+does not change the core agent's zero-dependency design.
+
+A richer Qt6 frontend (`enodia-sentinel gui-qt` / `enodia-sentinel-gui-qt`,
+`[qt]` extra with `PySide6`) provides the same data with a native look,
+resizable tables, and a response-plan detail pane.
+
 ## Alert Workflow
 
 When Sentinel fires:

docs/ROADMAP.md

@@ -116,6 +116,15 @@ Purpose: define a stable single-host product.
 - ✅ Add an optional desktop tray applet (`enodia-sentinel-tray`, `[tray]`
   extra): dashboard launcher, systemd daemon control, status at a glance, and
   `check --json` quick checks, with GUI-free tested logic modules.
+- ✅ Add an optional stdlib tkinter desktop dashboard (`enodia-sentinel gui` /
+  `enodia-sentinel-gui`): tabs for status, alerts, incidents, posture,
+  integrity, response plans, and events, plus daemon-control buttons and
+  threaded refresh. All testable logic is GUI-free; only `app.py` imports
+  tkinter.
+- ✅ Add an optional Qt6 desktop dashboard (`enodia-sentinel gui-qt` /
+  `enodia-sentinel-gui-qt`, `[qt]` extra with `PySide6`): native tabs and
+  tables, severity row coloring, response-plan detail pane, keyboard shortcuts,
+  and safe threaded background refresh.
 - Keep the dashboard read-only unless a separate authenticated write path is
   designed and reviewed.