test(scripts): normalize line endings on read instead of per assertion

[PathGao]

846b84b2 in #452 fixed this suite on Windows by hand, one assertion at a time,
in the middle of cutting a release. That should not have been your job — the
tests are mine, and the reason fifteen of them broke is that fifty of them each
made the same decision separately. This moves the decision to one place and adds
the guard that keeps it there.

This is test-only. No src/, no src-tauri/, no product behaviour; the only
non-scripts/ file is a new .gitattributes. Merge it before or after v2.7.0 —
whichever suits the release you have in flight. There is no rush and nothing here
that a user can see.

Root cause

Two halves, both the same shape: a decision that belongs on the read, made at
every call site instead.

Line endings. The repo has no .gitattributes, so a Windows clone with the
default core.autocrlf=true checks the entire tree out CRLF. Every test that
reads src/ as text then matches it against a pattern containing a literal \n,
or slices it with an anchor containing one, and none of those match the bytes on
disk. sliceBetween reports it as expected to find "…" for an anchor that is
sitting right there in the file.

Path separators. walkSourceFiles() in sourceTree.ts has always done
.replace(/\\/g, '/'). i18nCoverage.test.ts and monacoStartupGraph.test.ts
each carried their own private copy of the walk, so neither inherited it — which
is precisely what sourceTree.ts's header comment says the module exists to
prevent ("Three copies of walk() used to live in …. One copy each, here.").

What this does

1. readSource(path) in sourceTree.ts.

export function readSource(path: string | URL): string {
	return readFileSync(path, 'utf8').replace(/\r\n/g, '\n');
}

string | URL because both spellings were already in use — a cwd-relative string
and new URL('../src/…', import.meta.url) — so no call site had to change shape
to get normalized. Documented at the length the neighbouring helpers are, naming
#452, so the next reader cannot mistake it for indirection for its own sake.

2. 60 files, 135 call sites routed through it — and the \r? workarounds
removed where they become redundant. That is the point: the assertion goes back
to reading as \n, which is the form the files have in the repository, and the
normalization happens once.

Deliberately left alone: the CRLF fixtures in frontMatter.test.ts,
frontMatterProseBlock.test.ts and pasteUrlContext.test.ts. Those assert on the
parser's handling of a CRLF document, and each spells the document as a literal
in the test — which is the right way round. A fixture whose bytes are the point
must not depend on what Git checked out.

3. Both private walkers folded into walkSourceFiles. Filters checked first:
i18nCoverage's was .svelte || .ts against walkSourceFiles's
.ts|.svelte|.js — the same set today, since src/ has no .js, and the wider
one is the one that should win (a .js file calling t() is a file whose keys
must resolve). monacoStartupGraph's was /\.(svelte|ts|js)$/, identical. Neither
needed walkSourceFiles widened with an argument.

One of your fifteen patches is not subsumed and stays: the
.replace(/\\/g, '/') on relative(process.cwd(), f) in monacoStartupGraph.
That normalizes the output of the import-graph walk, which resolves absolute paths
and never goes through walkSourceFiles — a real separator fix, not a symptom of
the duplication.

4. The guard, as two rows in singleImplementationConvention.test.ts's RULES
rather than a new mechanism — that file already is where a convention like this is
written down. The only thing it could not express was a rule about the suite
itself, because SOURCES was fixed to src; rules now take an optional dir and
the tree walk is memoized per directory. Everything existing is unchanged.

marker	allowed in
readFileSync(	scripts/sourceTree.ts
readdirSync(	scripts/sourceTree.ts

Both markers are the call, not the import — import { readFileSync } on its own
reads nothing. Both messages name the replacement and how to call it. The existing
every rule keeps at least one live implementation test covers the new rows, so a
marker that stops matching sourceTree.ts is reported rather than silently
guarding nothing.

5. .gitattributes — * text=auto eol=lf, with .nsi/.nsh/.ps1/.bat/.cmd
pinned to CRLF. Those are read by NSIS and Chocolatey on Windows and are pinned so
the bytes those toolchains see stay identical to what a core.autocrlf=true runner
hands them today; this is not the PR to also change the installer build. Every
tracked file in the repo is LF right now (verified — git add --renormalize .
stages nothing outside this branch's own edits), so no stored bytes change and no
Linux or macOS working tree changes. What changes is the next Windows clone.

Why both. .gitattributes is the belt and it is the weaker half on purpose: it
does not touch a tree that is already checked out — that needs
git add --renormalize . — and it cannot stop an editor from writing CRLF into a
file it saves. readSource is the braces, and it is the half that actually holds.

Falsification

The guard catches existing drift. Run before either cleanup, against master:

rule	files flagged on first run
readFileSync( outside sourceTree.ts	59
readdirSync( outside sourceTree.ts	2 (i18nCoverage, monacoStartupGraph)

The fix fixes the Windows case. Measured on macOS by converting every tracked
text file to CRLF end to end — src/, src-tauri/, scripts/, the workflows,
snapcraft.yaml, Cargo.toml, the JSON — and running the suite, then restoring.

tree	CRLF result
master as it stands	596/596 pass — your patch works
master with 846b84b2 reverse-applied	21 tests fail across 8 files
this branch	598/598 pass, with the workarounds deleted rather than kept
this branch, readSource reduced to a plain read	21 tests fail across 8 files — the same set

The last two rows are the pair that matters: one line of normalization does
character-for-character the work that 33 hand-edited characters across 15 files
were doing, and rolling back only that line reproduces the failure exactly.

The 8 files that genuinely reddened are foldStatePerDocument,
issue281MinimalMacosMenu, liveModeWatchedPath, macosPdfExport,
menuModalGuards, windowOrganization, windowStateRestore,
youtubeExternalFallback. Of the other seven you patched, two were the
path-separator half — which a macOS run cannot reproduce at all, since it is
backslashes and not \r — and five were precautionary: their patterns already
tolerated the extra \r because a neighbouring \s* absorbed it. Those five are
reverted here as no-ops, not as behaviour changes.

Verification

npm test              598/598 pass, 0 fail          (596 before; +2 are the new rules)
npm run check         638 files, 0 errors, 0 warnings
cargo test            150/150 pass

.github/workflows/test.yml runs npm ci, npm audit, npm run check, npm test
and cargo test; all of them are above except npm audit, which this branch cannot
affect — no dependency changed and package-lock.json is untouched.

Each of the three commits was also checked out and run on its own — 596, 596, 598,
zero failures — so the 62-file diff is reviewable commit by commit rather than only
at the tip.

Not touched, on purpose: src-tauri/ in any form, including
src-tauri/src/tab_transfer.rs.