make the test suite and openapi generator platform-independent

Windows checkouts turned LF into CRLF (core.autocrlf=true), and several
tests plus the openapi generator hardcoded LF or POSIX path separators.
The result was a suite that was green on Linux CI but red on Windows, and
an openapi.json whose /api/hermes/* routes silently disappeared when
generated on Windows.

Pin the repository to LF via .gitattributes, strip shebangs before
Vite's SSR transform, and key route files by their posix path. Add a
manually triggered macOS verification workflow so the same checks run
on a self-hosted macOS runner.

tests/server/no-legacy-brand.test.ts

@@ -264,8 +264,14 @@ describe('legacy brand removal (ekko / hermes-web-ui / hermes-studio)', () => {
       const marker = `const ${name} = [`
       const start = harness.indexOf(marker)
       expect(start, `${HARNESS_SCRIPT} 里找不到 ${name}，本测试需要同步更新`).toBeGreaterThan(-1)
-      const end = harness.indexOf('\n]\n', start)
-      expect(end, `${HARNESS_SCRIPT} 里的 ${name} 数组没有正确闭合`).toBeGreaterThan(start)
+      // 行尾不能写死 '\n]'：Windows 上 checkout 会把 LF 转成 CRLF
+      // （core.autocrlf=true），写死 LF 的话这个测试只会在 Windows 上红，
+      // Linux CI 上却是绿的。仓库的 .gitattributes 已把行尾统一成 LF，但
+      // 在它被加进来之前 checkout 过的工作区仍留着 CRLF，所以这里两种都要认。
+      const rest = harness.slice(start)
+      const closeMatch = /\r?\n\]/.exec(rest)
+      expect(closeMatch, `${HARNESS_SCRIPT} 里的 ${name} 数组没有正确闭合`).not.toBeNull()
+      const end = start + closeMatch!.index
       return harness.slice(start + marker.length - 1, end + 2)
     }