fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/components/ui/uiI18n.contract.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { readSources } from "../../lib/rawSources.testkit";
 
 // The platform layer (`components/ui/`) may not import a feature component or a domain API slice —
 // eslint's `no-restricted-imports` enforces that. It cannot see an i18n KEY, though, and two
@@ -17,11 +18,7 @@ const PLATFORM_NAMESPACES = new Set([
   "time",
 ]);
 
-const files = import.meta.glob("./**/*.{ts,tsx}", {
-  query: "?raw",
-  import: "default",
-  eager: true,
-});
+const files = readSources(__dirname, "./**/*.{ts,tsx}");
 // `t("ns.…")` and `t(\`ns.…\`)` — the namespace is everything before the first dot.
 const KEY = /\bt\(\s*["`]([A-Za-z]+)\./g;