fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/components/listNav.wiring.contract.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { readSources } from "../lib/rawSources.testkit";
 
 // Every rail and every card of a card list is walkable by the keyboard (lib/listNav). Two
 // opt-in halves, both checked here, because either one missing silently leaves the keyboard out —
@@ -79,7 +80,7 @@ export function inList(code: string, pos: number): boolean {
 const has = (tag: Tag, prop: string) => new RegExp(`\\s${prop}\\b`).test(tag.text);
 
 function offenders(): { hits: string[]; tags: number; exempted: Set<string> } {
-  const files = import.meta.glob("./**/*.tsx", { query: "?raw", import: "default", eager: true });
+  const files = readSources(__dirname, "./**/*.tsx");
   const hits: string[] = [];
   const exempted = new Set<string>();
   let tags = 0;