feat(menu): group keybinds cheatsheet Window/Workspace/Menu/Media (#108)

Every bind in keybinds.nix carries a group; SUPER+? renders section
headers. checks.keybinds-cheatsheet asserts all groups are valid and
every description appears in the sheet (same source as Hyprland binds).

Verified: V0 flake check; built cheatsheet shows ── Window ── / etc.

flake.nix

@@ -477,6 +477,48 @@
               touch $out
             '';
 
+          # Keybinds cheatsheet completeness + grouping (#108): every bind
+          # from keybinds.nix has a group, and every desc appears in the
+          # rendered cheatsheet (same source hyprland.nix binds from).
+          keybinds-cheatsheet =
+            let
+              inherit (nixpkgs.lib) assertMsg concatLists concatMapStringsSep
+                concatStringsSep elem filter hasInfix;
+              kb = import ./modules/home/keybinds.nix;
+              groups = [ "Window" "Workspace" "Menu" "Media" ];
+              allBinds = kb.binds ++ kb.multiLayoutBinds;
+              badGroup = filter (b: !(elem (b.group or null) groups)) allBinds;
+              extraBad = filter (e: !(elem (e.group or null) groups)) kb.extra;
+              descs = map (b: b.desc) allBinds ++ map (e: e.desc) kb.extra;
+              linesFor = g:
+                let rows = filter (b: b.group == g) allBinds
+                    ++ filter (e: e.group == g) kb.extra;
+                in if rows == [ ] then [ ]
+                   else [ ("── " + g + " ──") ] ++ map (r: r.desc) rows;
+              sheet = concatStringsSep "\n" (concatLists (map linesFor groups));
+              missing = filter (d: !(hasInfix d sheet)) descs;
+              ok = badGroup == [ ] && extraBad == [ ] && missing == [ ]
+                && hasInfix "── Window ──" sheet
+                && hasInfix "── Workspace ──" sheet
+                && hasInfix "── Menu ──" sheet
+                && hasInfix "── Media ──" sheet;
+              msg =
+                (if badGroup != [ ] then
+                  "binds missing/invalid group: "
+                  + concatMapStringsSep ", " (b: b.desc) badGroup + "\n"
+                 else "")
+                + (if extraBad != [ ] then
+                  "extra missing/invalid group: "
+                  + concatMapStringsSep ", " (e: e.desc) extraBad + "\n"
+                 else "")
+                + (if missing != [ ] then
+                  "descs missing from grouped sheet: "
+                  + concatStringsSep ", " missing + "\n"
+                 else "");
+            in
+            assert assertMsg ok ("keybinds-cheatsheet: " + msg);
+            pkgs.runCommand "nomarchy-keybinds-cheatsheet" { } "touch $out";
+
           # Installer keyboard no-variant regression (item 91): gum's `(none)`
           # row is display-only.  Exercise it through the real template
           # patcher, then build the exact us + empty-variant console keymap