make the test suite and openapi generator platform-independent

Windows checkouts turned LF into CRLF (core.autocrlf=true), and several
tests plus the openapi generator hardcoded LF or POSIX path separators.
The result was a suite that was green on Linux CI but red on Windows, and
an openapi.json whose /api/hermes/* routes silently disappeared when
generated on Windows.

Pin the repository to LF via .gitattributes, strip shebangs before
Vite's SSR transform, and key route files by their posix path. Add a
manually triggered macOS verification workflow so the same checks run
on a self-hosted macOS runner.

vitest.config.ts

@@ -1,9 +1,29 @@
-import { defineConfig } from 'vitest/config'
+import { defineConfig, type Plugin } from 'vitest/config'
 import vue from '@vitejs/plugin-vue'
 import { resolve } from 'path'
 
+/**
+ * Vite 的 SSR 变换用 `/^#!.*\n/` 识别 shebang，并把 import 声明提升到它前面。
+ * 这个正则只在 LF 工作区成立：`.` 不匹配 `\r`，所以 CRLF checkout（Windows 默认
+ * core.autocrlf=true）下 shebang 识别失败，import 被提升到 `#!/usr/bin/env node`
+ * 之前，shebang 落到文件中部，运行期直接抛 "Invalid or unexpected token"。
+ *
+ * 统一在 SSR 变换之前剥掉 shebang：它只对「直接执行」有意义，测试里不需要。
+ */
+function stripShebang(): Plugin {
+  return {
+    name: 'hermes:strip-shebang',
+    enforce: 'pre',
+    transform(code, id) {
+      if (!code.startsWith('#!')) return null
+      const newline = code.indexOf('\n')
+      return { code: newline === -1 ? '' : code.slice(newline + 1), map: null }
+    },
+  }
+}
+
 export default defineConfig({
-  plugins: [vue()],
+  plugins: [stripShebang(), vue()],
   resolve: {
     alias: {
       '@': resolve(__dirname, 'packages/client/src'),