fix(ci): renormalize docker.yml to LF — and fail CI on CRLF blobs

[MrChengLen]

What

• .github/workflows/docker.yml back to LF. Stored with CRLF since f72dedc (PR ci(docker): allow a manual rebuild via workflow_dispatch #129), although .gitattributes pins *.yml to LF. No content change: git diff -w against main is empty, and the new blob is the old one with every CRLF replaced by LF (git ls-files --eol now shows i/lf).
• New guard tests/test_line_endings.py. Reads git ls-files --eol and fails when any tracked file's index blob is CRLF or mixed, unless .gitattributes marks it -text.
• CHANGELOG entry.

Why

f72dedc was created via createCommitOnBranch, which stores exactly the bytes it is sent, and those bytes had CRLF line endings. The 11-line change already showed as 223 changed lines, and the next ordinary edit would renormalise all 117 lines into another whole-file diff. That's the same class of problem as requirements.lock in 7caa75e (PR #81), repaired in PR #85.

The guard covers every tracked file, not only *.yml/*.py/*.md. * text=auto normalises all text, and the files most at risk are the text=auto ones that a Windows checkout writes as CRLF. It asserts "not CRLF/mixed" rather than "is LF", because i/none is legitimate: the .gitkeep files and the one-line Tailwind bundle have no line endings at all.

Dependabot #131

It bumps two actions in docker.yml on top of the CRLF version. I checked with git merge-tree: it will conflict once this lands, because every line differs on one side. Dependabot rebases conflicted PRs by default, which regenerates the 2-line bump on the LF file, and CI then runs the new guard on it.

Overlap with #146

pr-ci-lockfile-parity renormalises docker.yml too, and deliberately. Its blob is byte-identical to this one (01f23fd), and its real change to the file is empty. So the two PRs don't conflict on docker.yml; whichever merges second simply loses that part of its diff. Its CHANGELOG.md entry will need the usual 3-way merge.

Rebased

Rebased twice, each time because another PR added a CHANGELOG.md entry: onto 4dcd69d (after #143 and #145), then onto 51745d5 (after #148). The only conflict each time was CHANGELOG.md. This entry now sits on top of theirs, and the diff against main is exactly this block. It's still a single commit with the same three files and the same docker.yml blob. All five checks were green on both earlier heads (6c99cbe, ef183de).

Verification

• New test red against an index built from main (51745d5): it names exactly .github/workflows/docker.yml. Green with this change.
• Edge cases checked with a synthetic index: a CRLF blob marked -text is exempt, i/mixed is flagged, and an empty w/ column and a non-ASCII path both parse.
• Full suite on Windows after the rebase: 1231 passed, 63 skipped. The WeasyPrint/pikepdf tests only run here in CI.
• ruff check + format clean; gitleaks and the pre-commit scope guard clean.
• security-auditor: PASS. code-reviewer: approve; its docstring and wording fixes are applied.

🤖 Generated with Claude Code