build: pin line endings to LF so the embedded bootstrap.sh ships without CRs

The repository had no .gitattributes. With core.autocrlf=true a Windows checkout
handed deploy/bootstrap.sh 2374 CRs, and bootstrap_asset.go embeds that file from
the working tree verbatim, so a dev-built felis piped a CRLF script into `bash -s`
on the target host. CI builds on Linux, which is why released binaries were clean
and only local builds carried it.

eol=lf is global rather than scoped to *.sh because go:embed reaches further than
the installer: deploy/*/Dockerfile, deploy/*/entrypoint.sh, plugins/*/src, the
migrations and internal/panel/static are all compiled in and read on Linux. *.bat
is the one exception, for the gradle wrappers' Windows launchers.

Renormalizing the index touched exactly one tracked file, cmd/felis/version.go,
and only its line endings: `git diff --cached --ignore-cr-at-eol` reports nothing
outside .gitattributes itself.

TestBootstrapPinsViaBlockConnectionsOff used to strip \r\n before asserting, with a
comment stating that the repository pinned no eol attribute. That is no longer true,
and the stripping hid the regression this commit prevents. It now asserts the absence
of CRs, so losing the attribute reports itself as line endings rather than as a
missing serverside-blockconnections pin.

Closes #5

.gitattributes

@@ -0,0 +1,8 @@
+# Everything in this repository is consumed on Linux: deploy/bootstrap.sh is embedded
+# verbatim by bootstrap_asset.go and piped into `bash -s`, the Dockerfiles and entrypoints
+# are read inside the images, and the operator ships YAML. Without eol=lf a Windows
+# checkout under core.autocrlf=true hands all of them CRs.
+* text=auto eol=lf
+
+# The gradle wrappers' Windows launchers are the one thing that wants CRLF.
+*.bat text eol=crlf

bootstrap_asset_test.go

@@ -73,9 +73,15 @@ func TestLobbyLuckPermsWiringIsConsistent(t *testing.T) {
 // default it can inherit — and nothing else in the install would notice it missing. The failure
 // surfaces only when a legacy player joins, on a host that installed cleanly.
 func TestBootstrapPinsViaBlockConnectionsOff(t *testing.T) {
-	// go:embed takes the working tree verbatim, and this repository pins no eol attribute, so
-	// a Windows checkout embeds CRLF. Only the assertion spanning a line break below cares.
-	script := strings.ReplaceAll(BootstrapScript(), "\r\n", "\n")
+	// go:embed takes the working tree verbatim, so the eol attribute is what keeps a Windows
+	// checkout from compiling CRs into the installer. Assert it rather than normalizing them
+	// away: the only assertion that would otherwise notice is the one spanning a line break
+	// below, and it would report a missing pin instead of the line endings.
+	script := BootstrapScript()
+	if strings.Contains(script, "\r\n") {
+		t.Fatal("embedded bootstrap.sh has CRLF line endings; .gitattributes pins *.sh to LF " +
+			"and this script is piped into `bash -s` on a Linux host")
+	}
 
 	const key = "serverside-blockconnections"
 	if !strings.Contains(script, key+": false") {