make verify: add the Lens pass container (both apps, cheapest first)

Root verify runs check first, then a per-app verify in each Makefile: sensor
slots hooked to VERIFY_SENSORS (empty today, so nothing is claimed that is not
run) and then that app's suite. Measured: 9.9s wall, app 178 + blogex 156 tests.

app/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps compile test format credo
+.PHONY: check precommit deps compile test format credo verify
 
 # Run all static analysis checks (no database required)
 check: credo format
@@ -94,4 +94,27 @@ playwright-full: playwright-docker-start
 
 # Run Credo static analysis
 credo:
-	$(MISE_EXEC) mix credo --strict
+	$(MISE_EXEC) mix credo --strict
+
+# =============================================================================
+# Lens pass (heavy checks; root `make verify` runs this before every push)
+# =============================================================================
+#
+# Sensor slots, cheapest first. Credo is cheap enough that it lives in
+# `check`, not here. Add a sensor as its yak lands, both as a target and to
+# VERIFY_SENSORS — that variable is the single source of truth for what this
+# target reports as wired.
+#   - sobelow    (yak: sobelow in the Lens pass)
+#   - coverage   (yak: coverage floors + framework-glue exclusions policy)
+#   - crap       (yak: CRAP scores with ex_crap (both apps))
+#   - mutation   (yak: mutation testing with muex — a sensor, not a gate)
+#
+# Runtime note: the coverage yak should make this export coverage from a single
+# suite run (test --cover --export-coverage) that CRAP reuses, instead of
+# running the suite twice.
+VERIFY_SENSORS :=
+
+verify:
+	@echo "==> verify(app): sensors [$(if $(VERIFY_SENSORS),$(VERIFY_SENSORS),none wired yet)]"
+	@for sensor in $(VERIFY_SENSORS); do $(MAKE) $$sensor || exit 1; done
+	@$(MAKE) test