feat(menu): group keybinds cheatsheet Window/Workspace/Menu/Media (#108)

Every bind in keybinds.nix carries a group; SUPER+? renders section
headers. checks.keybinds-cheatsheet asserts all groups are valid and
every description appears in the sheet (same source as Hyprland binds).

Verified: V0 flake check; built cheatsheet shows ── Window ── / etc.

docs/ROADMAP.md

@@ -404,6 +404,10 @@ Design/decision records and a running log of shipped work (items marked
   decision rather than a drive-by. Proved to fail: dropping snapshot makes it
   name the missing entry. **V3 pending** — that the apps *launch* needs real
   hardware (HARDWARE-QUEUE, Acer M5-481T).
+- ✓ **Keybinds cheatsheet groups (#108):** SUPER+? sections Window /
+  Workspace / Menu / Media from keybinds.nix `group`; 
+  `checks.keybinds-cheatsheet` fails if a bind lacks a group or a desc is
+  missing from the sheet.
 - ✓ **Fix batch #112 / #106 / #113:** installer disk picker drops fd0/loop/
   optical/<8 GiB and lists largest-first (OVMF no longer defaults to floppy);
   `checks.menu-back` guards every internal rofi list emits ↩ Back; offline