feat(gui): add optional tkinter and Qt6 desktop dashboards

Add two optional windowed frontends over the same local state the TUI and
web console read: `enodia-sentinel gui` (stdlib tkinter) and
`enodia-sentinel gui-qt` (PySide6, new `[qt]` extra).

Both share `gui/model.py`, a GUI-free presentation model over
`tui.collect_model`, so every formatter is unit-testable without a display
server. Only `app.py` and `qt_app.py` import GUI libraries, enforced by
import-guard tests mirroring the tray applet's boundary.

Tabs cover status, alerts, incidents, posture, integrity, response plans,
and the event tail, plus daemon-control buttons via systemctl. Response
plans are display-only; the GUIs never execute containment commands. Core
runtime dependencies stay empty.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JX86xeoBJVBb16qHkDf53K

docs/ROADMAP.md

@@ -116,6 +116,15 @@ Purpose: define a stable single-host product.
 - ✅ Add an optional desktop tray applet (`enodia-sentinel-tray`, `[tray]`
   extra): dashboard launcher, systemd daemon control, status at a glance, and
   `check --json` quick checks, with GUI-free tested logic modules.
+- ✅ Add an optional stdlib tkinter desktop dashboard (`enodia-sentinel gui` /
+  `enodia-sentinel-gui`): tabs for status, alerts, incidents, posture,
+  integrity, response plans, and events, plus daemon-control buttons and
+  threaded refresh. All testable logic is GUI-free; only `app.py` imports
+  tkinter.
+- ✅ Add an optional Qt6 desktop dashboard (`enodia-sentinel gui-qt` /
+  `enodia-sentinel-gui-qt`, `[qt]` extra with `PySide6`): native tabs and
+  tables, severity row coloring, response-plan detail pane, keyboard shortcuts,
+  and safe threaded background refresh.
 - Keep the dashboard read-only unless a separate authenticated write path is
   designed and reviewed.