make the test suite and openapi generator platform-independent

Windows checkouts turned LF into CRLF (core.autocrlf=true), and several
tests plus the openapi generator hardcoded LF or POSIX path separators.
The result was a suite that was green on Linux CI but red on Windows, and
an openapi.json whose /api/hermes/* routes silently disappeared when
generated on Windows.

Pin the repository to LF via .gitattributes, strip shebangs before
Vite's SSR transform, and key route files by their posix path. Add a
manually triggered macOS verification workflow so the same checks run
on a self-hosted macOS runner.

tests/server/write-gate-service.test.ts

@@ -117,7 +117,9 @@ describe('write gate service', () => {
     expect(isWriteGateSupported()).toBe(true)
   })
 
-  it('detects write approval support from a pip-installed runtime Python', async () => {
+  // 假 python 是 #!/bin/sh 脚本，能力探测要真的把它跑起来。Windows 没有
+  // shebang 执行语义，这个用例只在 POSIX 上有意义。
+  it.skipIf(process.platform === 'win32')('detects write approval support from a pip-installed runtime Python', async () => {
     const fakePython = join(hermesHome, 'python')
     await writeFile(fakePython, [
       '#!/bin/sh',