fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/lib/mutationFailures.contract.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { readSources } from "./rawSources.testkit";
 
 // Every `useMutation` NAMES what failed (owner decision: the toast's title says what, the
 // line under it why). The app-wide reporter (lib/queryClient) reports a mutation that names nothing
@@ -36,11 +37,7 @@ export function mutationCalls(source: string): string[] {
 }
 
 function unnamed(): { hits: string[]; mutations: number } {
-  const files = import.meta.glob("../**/*.{ts,tsx}", {
-    query: "?raw",
-    import: "default",
-    eager: true,
-  });
+  const files = readSources(__dirname, "../**/*.{ts,tsx}");
   const hits: string[] = [];
   let mutations = 0;
   for (const [rel, source] of Object.entries(files)) {