fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/components/ui/pageMenuScope.contract.test.ts

@@ -1,15 +1,17 @@
 import { describe, expect, it } from "vitest";
+import { readSources } from "../../lib/rawSources.testkit";
 
 // docs/DESIGN.md "Background menu": which pages have one is the owner's call (2026-09-26, scope A) —
 // the list pages whose toolbar sorts, filters or switches a view: the feed, the Plex library, the
 // channel manager, a playlist and the notification center. The tab-only pages (settings, config,
 // stats, users, downloads) keep the browser's menu. A page that starts rendering one fails here until
 // that decision is taken again.
-const files = import.meta.glob(["../**/*.tsx", "!../**/*.test.*", "!../design-lab/**", "!./**"], {
-  query: "?raw",
-  import: "default",
-  eager: true,
-}) as Record<string, string>;
+const files = readSources(__dirname, [
+  "../**/*.tsx",
+  "!../**/*.test.*",
+  "!../design-lab/**",
+  "!./**",
+]) as Record<string, string>;
 
 describe("the pages with a background menu", () => {
   it("are the five the owner chose", () => {