app: CRAP scores as a Lens sensor (ex_crap)

The coverage export from `test.coverage` now also feeds a `crap` sensor,
second in app's VERIFY_SENSORS. It runs with MIX_ENV=test so it reads the
export's own environment instead of compiling a dev build and scoring a
different module set, and it guards on the export's existence because
ex_crap silently falls back to 0% coverage when the file is missing.

Baseline at ex_crap's default threshold (30): 23 files, 139 functions,
worst score 20.00 (CoreComponents.table/1, 0% - unused upstream scaffold).
No offenders, so nothing to refactor or cover yet.

app/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps assets compile test test.coverage coverage format credo verify
+.PHONY: check precommit deps assets compile test test.coverage coverage crap format credo verify
 
 # Run all static analysis checks (no database required)
 check: credo format
@@ -48,6 +48,20 @@ coverage:
 	@test -f cover/default.coverdata || { echo "coverage: no exported coverage - run 'make test.coverage' first" >&2; exit 1; }
 	$(MISE_EXEC) mix test.coverage
 
+# Enforce CRAP scores (complexity x coverage) from the same export. No test run.
+# Runs in MIX_ENV=test because that is the environment the export came from:
+# running in dev would compile a second build and score against a different set
+# of modules. The guard is load-bearing for the same reason as `coverage`:
+# ex_crap falls back to 0% coverage when the export is missing, which would
+# report scores that are pessimistic instead of absent - a false failure is
+# less bad than a false pass, but neither is acceptable in the Lens pass.
+#
+# Threshold is ex_crap's default (30); whether to ratchet it down is an open
+# decision tracked in the "ratchets, deferred decisions, handoff practice" yak.
+crap:
+	@test -f cover/default.coverdata || { echo "crap: no exported coverage - run 'make test.coverage' first" >&2; exit 1; }
+	MIX_ENV=test $(MISE_EXEC) mix crap
+
 # Format code
 format:
 	$(MISE_EXEC) mix format
@@ -132,15 +146,16 @@ credo:
 #   - coverage   (yak: coverage floors + framework-glue exclusions policy)
 #                  WIRED below (test.coverage + coverage).
 #   - crap       (yak: CRAP scores with ex_crap (both apps))
+#                  WIRED below (crap); reuses the coverage export.
 #   - mutation   (yak: mutation testing with muex — a sensor, not a gate)
 #
 # Runtime note: the coverage sensor exports from a single suite run
-# (`test.coverage` -> `mix test --cover --export-coverage default`) that CRAP is
-# meant to reuse, instead of running the suite twice.
+# (`test.coverage` -> `mix test --cover --export-coverage default`) that CRAP
+# reuses, instead of running the suite twice.
 #
 # The suite runs FIRST, because it is what produces the coverage export the
 # sensors read; sensors still run cheapest-first among themselves.
-VERIFY_SENSORS := coverage
+VERIFY_SENSORS := coverage crap
 
 verify:
 	@echo "==> verify(app): suite (coverage exported), then sensors [$(VERIFY_SENSORS)]"