Add enforce.Guard port with X11 and no-op adapters

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/enforce/enforce.go

@@ -0,0 +1,16 @@
+// Package enforce makes drift cost something at the OS level. Tier A minimizes
+// the active window when the session is enforcing and the drift judge has
+// confirmed the window is off-task. The Guard is a pure OS primitive; all
+// policy — whether and when to enforce — lives in the session controller.
+package enforce
+
+import "context"
+
+// Guard performs OS-level enforcement actions on demand.
+type Guard interface {
+	// MinimizeActive minimizes the currently-focused window. It is idempotent
+	// (minimizing an already-minimized window is harmless) and best-effort: it
+	// returns an error for diagnostics, but callers never block on it and treat
+	// failure as "enforcement did nothing this time."
+	MinimizeActive(ctx context.Context) error
+}