make verify: add the Lens pass container (both apps, cheapest first)

Root verify runs check first, then a per-app verify in each Makefile: sensor
slots hooked to VERIFY_SENSORS (empty today, so nothing is claimed that is not
run) and then that app's suite. Measured: 9.9s wall, app 178 + blogex 156 tests.

blogex/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps compile test format
+.PHONY: check precommit deps compile test format verify
 
 # Cheap static gate for this library (no database, no coverage). Runs from the
 # root `make check`, which loops app then blogex.
@@ -33,3 +33,20 @@ test: deps
 # Format code
 format:
 	$(MISE_EXEC) mix format
+
+# =============================================================================
+# Lens pass (heavy checks; root `make verify` runs this before every push)
+# =============================================================================
+#
+# Sensor slots, cheapest first. Add a sensor as its yak lands, both as a target
+# and to VERIFY_SENSORS — that variable is the single source of truth for what
+# this target reports as wired.
+#   - coverage   (yak: coverage floors + framework-glue exclusions policy)
+#   - crap       (yak: CRAP scores with ex_crap (both apps))
+#   - mutation   (yak: mutation testing with muex — a sensor, not a gate)
+VERIFY_SENSORS :=
+
+verify:
+	@echo "==> verify(blogex): sensors [$(if $(VERIFY_SENSORS),$(VERIFY_SENSORS),none wired yet)]"
+	@for sensor in $(VERIFY_SENSORS); do $(MAKE) $$sensor || exit 1; done
+	@$(MAKE) test