fix: make line endings and repository paths platform-independent on Windows

[garyfischer-maker]

Summary

Running the full suite on Windows (core.autocrlf=true) produced 128 failures, nearly all from the checkout rather than the code:

• Line endings. Text was checked out as CRLF, which changed pinned SHA-256 hashes, evidence fingerprints and exact byte comparisons. .gitattributes now starts with * text=auto eol=lf; the existing -text rules for pinned native sources still take precedence. git add --renormalize . changes no committed file.
• Generator paths. acceptance-traceability.ts, audit-extension-packages.ts and audit-json-schemas.ts wrote \ paths on Windows, rewriting every row of the ledger and audit fixtures. They now record / paths and reproduce the committed fixtures byte-for-byte.
• Path-safety checks. scripts/core-ideals/*, export-domain-pack.ts and domain-pack-family.ts compared relative() output with / paths. On Windows that flagged valid evidence paths as unsafe, and startsWith('../') never rejected a ..\ escape. Both are now normalized to /.

Verification (Windows 11, Bun 1.3.14)

• Full suite: 128 → 11 failures; none of the remaining 11 is caused by Windows (below)
• bun run typecheck: clean
• bun run test:schemas, bun scripts/acceptance-traceability.ts: no diff against committed fixtures

Remaining failures (not changed by this PR, platform-independent)

CI runs only tests/domain-packs, so these don't show there:

• 8 tests: core-ideals browser evidence records Chromium 153.0.8010.12, but cardinality, facets and key evidence expects 148.0.7778.0
• 1 test: fixtures/validation/relationship-gate-refresh.json pins an older hash of native/tablespec/sources/tests/unit/test_umf_loader.py (the file changed in 436e975)
• 2 tests: need a built dist/avro-facet-selection.js

Environment-only failures on the test machine: protoc and go are not installed (8 tests). Bun applies patches/jsonld@9.0.0.patch with CRLF on Windows, so one installed-hash check fails (the hashes match once the files are converted to LF).

Note for existing Windows clones

Existing checkouts keep their CRLF files until re-checked out, e.g. git rm -r --cached -q . && git reset --hard on a clean tree.

🤖 Generated with Claude Code