fix(windows-ci): pin LF on extensionless executables (setup, bin/*, scripts/*)

Round 8 of windows-free-tests fixes. Round 7 cleared find-browse + most
shards; one fail left in shard 7:

  test/setup-codesign.test.ts > codesign shell snippet is syntactically valid
  expect(received).toBeTruthy() — match was null

The test extracts a bash codesign block from the `setup` file via a
\\n-anchored regex, then syntax-checks it with `bash -n`. On Windows the
regex returned null because the `setup` file was checked out with CRLF
endings — my round-2 .gitattributes only covered files matched by extension
patterns (*.md, *.sh, *.ts) and `setup` is extensionless.

Fix: extend .gitattributes with explicit rules for extensionless executables:
  setup        text eol=lf
  bin/*        text eol=lf
  **/scripts/* text eol=lf

This also LF-pins all the bash bin/ scripts (gstack-paths, gstack-slug,
gstack-codex-probe, ...) which would otherwise break with "bad interpreter"
errors on Linux if a Windows contributor accidentally committed CRLF
versions. Defense in depth.

Verified locally: `git check-attr eol setup bin/gstack-paths` reports
`eol: lf` for both. Renormalized via `git add --renormalize` so any
already-LF files in the repo stay LF after the .gitattributes change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -14,6 +14,15 @@
 *.sh         text eol=lf
 *.bash       text eol=lf
 
+# Extensionless executables (top-level setup script + bin/gstack-* helpers).
+# These are bash scripts checked into git without a `.sh` suffix. Without
+# explicit eol=lf, Windows checkout with core.autocrlf=true converts them
+# to CRLF and breaks both `\n`-anchored regex tests (test/setup-codesign.test.ts)
+# and shebang resolution if the script is ever executed on Linux.
+setup        text eol=lf
+bin/*        text eol=lf
+**/scripts/* text eol=lf
+
 # TypeScript/JavaScript: LF for portability across the bun toolchain.
 *.ts         text eol=lf
 *.tsx        text eol=lf