fix(build): preserve LF for shell entrypoints

.gitattributes

@@ -1,3 +1,8 @@
 # Vendored tree-sitter grammars — machine-generated, hide from stats and diffs
 internal/cbm/vendored/grammars/**/parser.c  linguist-generated=true diff=false
 internal/cbm/vendored/grammars/**/scanner.c linguist-generated=true diff=false
+
+# Shell entrypoints must stay executable from Windows checkouts mounted in WSL.
+*.sh                           text eol=lf
+scripts/git-hooks/commit-msg   text eol=lf
+scripts/hooks/pre-commit       text eol=lf

scripts/test.sh

@@ -85,6 +85,9 @@ bash "$ROOT/tests/test_makefile_ts_runtime_dependencies.sh"
 echo "=== Step 0g: security fuzz harness self-test ==="
 bash "$ROOT/tests/test_security_fuzz_harness.sh"
 
+echo "=== Step 0h: shell line-ending contract ==="
+bash "$ROOT/tests/test_shell_line_endings.sh"
+
 # Verify compiler supports target arch
 verify_compiler "$CC"
 

tests/test_shell_line_endings.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Regression guard: shell entrypoints must remain LF in Windows checkouts so
+# they can run directly from WSL and MSYS without a `bash\r` shebang failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+failures=0
+checked=0
+while IFS= read -r -d '' path &&
+    IFS= read -r -d '' attribute &&
+    IFS= read -r -d '' eol; do
+    checked=$((checked + 1))
+    if [[ "$eol" != "lf" ]]; then
+        echo "FAIL: $path must declare eol=lf (got ${eol:-unset})" >&2
+        failures=$((failures + 1))
+    fi
+done < <(
+    git ls-files -z '*.sh' 'scripts/git-hooks/*' 'scripts/hooks/*' |
+        git check-attr -z --stdin eol
+)
+
+if (( failures > 0 )); then
+    echo "FAIL: $failures shell entrypoint(s) lack an LF checkout contract" >&2
+    exit 1
+fi
+
+echo "Shell line-ending contract passed ($checked files)"