fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/lib/nextPage.wiring.contract.test.ts

@@ -1,14 +1,11 @@
 import { describe, expect, it } from "vitest";
+import { readSources } from "./rawSources.testkit";
 
 // Every infinite list's read-ahead waits while the list fetches ANYTHING and runs again when the fetch
 // settles. A read-ahead that only checks `isFetchingNextPage` calls during a background
 // refetch, joins it through NEXT_PAGE and loads no page: the grid stalls at its loaded end until the
 // reader scrolls the range. The jsdom virtualizer measures nothing, so the wiring is pinned in source.
-const files = import.meta.glob(["../components/**/*.tsx", "!../components/**/*.test.tsx"], {
-  query: "?raw",
-  import: "default",
-  eager: true,
-});
+const files = readSources(__dirname, ["../components/**/*.tsx", "!../components/**/*.test.tsx"]);
 const source = (name: string) => {
   const hit = Object.entries(files).find(([path]) => path.endsWith(`/${name}`));
   if (!hit) throw new Error(`no ${name}`);