fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/src/lib/planCodes.contract.test.ts

@@ -89,6 +89,20 @@ describe("plan codes", () => {
     expect(clean.filter(isPlanCode)).toEqual([]);
   });
 
+  it("are what the audit metric counts by (its copy of the patterns is held equal here)", () => {
+    const py = readFileSync(new URL("scripts/audit_metrics.py", REPO), "utf8");
+    // A pattern there is `NAME = re.compile(r"…" r"…", re.ASCII)`: its raw literals, joined.
+    const pattern = (name: string) => {
+      const start = py.indexOf(`${name} = re.compile(`);
+      const call = py.slice(start, py.indexOf("re.ASCII", start));
+      return [...call.matchAll(/r(["'])(.*?)\1/g)].map((m) => m[2]).join("");
+    };
+    // JavaScript's source escapes the slash a regex literal needs; Python's has none to escape.
+    const js = (re: RegExp) => re.source.split(String.raw`\/`).join("/");
+    expect(pattern("NOT_CODES")).toBe(js(NOT_CODES));
+    expect(pattern("PLAN_CODE")).toBe(PLAN_CODES.map(js).join("|"));
+  });
+
   it("are not cited in the code", () => {
     const files = tracked();
     expect(files.length).toBeGreaterThan(1000); // a scan that reads nothing is green over nothing