Pin LF working trees via .gitattributes

The repo's committed content is already 100% LF (verified: 802/802
text files); until now the working-tree form depended on each
contributor's core.autocrlf, and autocrlf=true checkouts produced CRLF
working copies that byte-level gates had to tolerate (fence parsing,
consistency-record parsing, blob hashing, README splice comparison).
eol=lf removes the smudge boundary entirely: attributes override any
local autocrlf, so every checkout on every host sees the repo's
canonical form. git add --renormalize confirmed a zero-change no-op -
no committed blob (including vendor/) is rewritten. The script-side
CRLF tolerances remain as defense in depth for editor-introduced CRLF
in not-yet-committed files. If a file class ever needs CRLF in the
working tree (.bat/.cmd), a per-pattern eol=crlf override keeps the
in-repo form LF while smudging those checkouts only.

(cherry picked from commit 5d21ebee20391c3d5c1d3812bd3aaa92bc652973)

.gitattributes

@@ -0,0 +1,7 @@
+# The repo's canonical text form is LF, enforced at checkout too: no smudge
+# boundary between working tree and repo, so byte-level gates (verify-*
+# comparisons, blob hashing, coverage offsets) see one form on every host.
+# If a file class ever genuinely needs CRLF in the working tree (.bat/.cmd
+# for cmd.exe), add a `*.bat text eol=crlf` override AFTER this line — the
+# in-repo form stays LF; CRLF becomes checkout-time presentation only.
+* text=auto eol=lf