The repo already stored LF throughout (audited: 0 of the tracked text
blobs contain CR), but a Windows checkout with core.autocrlf=true
converted on the way out - which is how a built image once shipped a
CRLF shebang (N9). `* text=auto eol=lf` makes the checkout rule part of
the repo rather than each developer's config. Renormalising changed no
content.
Same root cause as the backend fix: no .gitattributes plus core.autocrlf
meant docker/40-render-config.sh was checked out with CRLF on Windows and
copied into the image that way.
Less severe here than in the backend, because nginx's docker-entrypoint.sh
sources a non-executable file in /docker-entrypoint.d rather than exec'ing
it, so the CRLF shebang is not fatal. It is still wrong, and it puts the
config-rendering step one permission change away from failing the same
opaque way. Pinning it keeps both images consistent.
TehRiehlDeal