chore: force LF on every text file, on every platform

The repo already stored LF throughout (audited: 0 of the tracked text
blobs contain CR), but a Windows checkout with core.autocrlf=true
converted on the way out - which is how a built image once shipped a
CRLF shebang (N9). `* text=auto eol=lf` makes the checkout rule part of
the repo rather than each developer's config. Renormalising changed no
content.

.gitattributes

@@ -1,13 +1,22 @@
-# Files that must keep LF regardless of the checkout platform.
-#
-# `core.autocrlf=true` is the Windows default, and `docker build` copies the
-# working tree into the image - so on a Windows checkout a CRLF shebang makes
-# the kernel look for an interpreter literally named "/bin/sh\r". That fails as
-# a bare "not found" with exit 127, which reads like a missing file rather than
-# a line-ending problem. CRLF also collapses backslash line continuations in a
-# Dockerfile RUN block.
-#
-# CI checks out on Linux and never saw this; only local builds break.
-*.sh        text eol=lf
-Dockerfile  text eol=lf
-Dockerfile.* text eol=lf
+# Every text file is LF, on every platform, whatever the developer's
+# core.autocrlf says. The repo already stored LF throughout; this stops a
+# Windows checkout converting to CRLF on the way out, which is what made
+# `docker build` ship a CRLF shebang (N9 in the audit), and which would change
+# the hash of anything hashed from a checkout rather than from the build.
+# `text=auto` lets git detect binaries it does not know; the explicit entries
+# below are the ones it must never touch.
+* text=auto eol=lf
+
+# Binaries: never normalise, never diff as text.
+*.png  binary
+*.jpg  binary
+*.jpeg binary
+*.ico  binary
+*.webp binary
+*.gif  binary
+*.mp3  binary
+*.wav  binary
+*.ogg  binary
+*.woff binary
+*.woff2 binary
+*.ttf  binary