fix(gate): knip sees the watch entry, the build must emit watch.html, and two hand copies are held

- The raw-source contract tests read files from disk (rawSources.testkit)
  instead of import.meta.glob, which knip counted as importing every src file —
  its unused-files lane could never name an orphan. knip now names
  src/watchMain.tsx as an entry (registered in docs/gates.md).
- vite build fails when index.html or watch.html is not emitted.
- The watch-entry import walk follows dynamic import() too.
- audit_metrics.py's plan-code patterns are held equal to the guard's.
- CrashBoundary is domain-free: it moves into components/ui.

frontend/vite.config.ts

@@ -28,6 +28,15 @@ const watchEntry = (): Plugin => ({
       next();
     });
   },
+  // The server answers every /watch/ link with the built watch.html, so a build without it would
+  // ship a 500 for each one, and nothing downstream reads `dist` before prod does. Fail it here —
+  // after Vite's own HTML plugin has emitted the pages (`enforce: "post"`), or none is there yet.
+  enforce: "post",
+  generateBundle(_options, bundle) {
+    for (const page of ["index.html", "watch.html"]) {
+      if (!(page in bundle)) this.error(`${page} was not built — add it to rollupOptions.input`);
+    }
+  },
 });
 
 export default defineConfig({