Add enforce.Guard port with X11 and no-op adapters

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/enforce/enforce_test.go

@@ -0,0 +1,14 @@
+package enforce
+
+import "testing"
+
+// NewGuard must return a usable Guard on every platform (real on linux, no-op
+// elsewhere). We assert non-nil only: calling MinimizeActive here would touch a
+// real X server on linux, which the integration test covers under a DISPLAY
+// guard. The behavioural contract is exercised in the session package via a fake
+// Guard.
+func TestNewGuardReturnsUsableGuard(t *testing.T) {
+	if g := NewGuard(); g == nil {
+		t.Fatal("NewGuard returned nil")
+	}
+}