make the test suite and openapi generator platform-independent

Windows checkouts turned LF into CRLF (core.autocrlf=true), and several
tests plus the openapi generator hardcoded LF or POSIX path separators.
The result was a suite that was green on Linux CI but red on Windows, and
an openapi.json whose /api/hermes/* routes silently disappeared when
generated on Windows.

Pin the repository to LF via .gitattributes, strip shebangs before
Vite's SSR transform, and key route files by their posix path. Add a
manually triggered macOS verification workflow so the same checks run
on a self-hosted macOS runner.

tests/server/agent-bridge-manager.test.ts

@@ -147,8 +147,19 @@ describe('agent bridge manager command resolution', () => {
   it('uses an isolated default bridge endpoint while running under Vitest', async () => {
     const { DEFAULT_AGENT_BRIDGE_ENDPOINT } = await import('../../packages/server/src/services/hermes/agent-bridge/client')
 
-    expect(DEFAULT_AGENT_BRIDGE_ENDPOINT).toContain(`hermes-agent-bridge-test-${process.pid}`)
+    // Vitest 下必须用「每个测试进程独立」的桥接端点，否则并行 worker 会抢同一个
+    // 生产 bridge。Windows 没有 unix socket 路径，测试端点走带 pid 偏移的 TCP 端口；
+    // POSIX 走带 pid 的 socket 文件。两种形态都要和生产的固定端点不同。
     expect(DEFAULT_AGENT_BRIDGE_ENDPOINT).not.toBe('ipc:///tmp/hermes-agent-bridge.sock')
+    expect(DEFAULT_AGENT_BRIDGE_ENDPOINT).not.toBe('tcp://127.0.0.1:18765')
+
+    if (process.platform === 'win32') {
+      const port = Number(DEFAULT_AGENT_BRIDGE_ENDPOINT.split(':').pop())
+      expect(port).toBeGreaterThanOrEqual(28000)
+      expect(port).toBeLessThanOrEqual(37999)
+    } else {
+      expect(DEFAULT_AGENT_BRIDGE_ENDPOINT).toContain(`hermes-agent-bridge-test-${process.pid}`)
+    }
   })
 
   it('honors the bridge connect retry environment override', async () => {