fix(windows): enforce LF line endings for shell scripts and Dockerfile

[szjanikowski]

Summary

• Repo-wide .gitattributes locks *.sh, Dockerfile, and other Linux-bound files to LF; PowerShell/batch keep CRLF. Fixes the silent failure where Windows core.autocrlf=true checked out test.sh with CRLF and Linux benchmark sandboxes read #!/bin/bash\r as the shebang, producing bash: required file not found and RewardFileNotFoundError on every trial.
• nasde init now scaffolds .gitattributes and writes files with Path.write_text(..., encoding="utf-8", newline="") so freshly-scaffolded test.sh is LF on Windows too (Python's default text mode translates \n → \r\n on Windows).
• Three benchmark-authoring skills (nasde-benchmark-creator, nasde-benchmark-from-history, nasde-benchmark-from-public-repos) got a "Critical: line endings on Windows" section so AI agents authoring benchmarks in user repos enforce the same policy.

Test plan

Linux/macOS — cross-platform regression check

• git checkout fix/gitattributes-lf && git status --porcelain → empty (no working-tree renormalization for files already LF in repo)
• uv run pytest -x → 147 passed (verifies _write_if_missing(newline="") doesn't break anything; on Linux/macOS \n was always written literally, so behavior is identical)
• uv run nasde init /tmp/x -n x; file /tmp/x/tasks/example-task/tests/test.sh → "ASCII text" without "CRLF"

Windows — verified end-to-end during PR development

• nasde install-skills --force → 4 skills installed
• nasde run --variant claude-vanilla --tasks python-gilded-rose-polymorphism -C examples/refactoring-skill --harbor-env daytona --without-eval → n_completed_trials: 1, n_errored_trials: 0; verifier ran the full pytest suite (23/23 passed); trial received a legitimate reward score (the agent's solution didn't satisfy all rubric criteria, but the system scored it correctly rather than crashing — that's the point: pipeline is healthy)
• uv run nasde init produced .gitattributes (1038 B) and test.sh (69 B, no \r byte) on Windows

🤖 Generated with Claude Code

[szjanikowski]

macOS smoke test results (2026-05-09)

Ran the first two items of the Linux/macOS regression checklist on macOS (Darwin 25.4.0, Python 3.13.11):

• ✅ git status --porcelain → empty (no renormalization). Branch checked out cleanly.
• ✅ uv run pytest -x → 147 passed in 0.89s.

The third item (nasde init + file CRLF check) was not executed in this smoke run.

Verdict: macOS-safe — no regression from .gitattributes changes.