fix: stop git normalising preserved bytes

SHA1 is the primary key of this collection and there was no
.gitattributes, so git guessed. Git for Windows sets core.autocrlf=true
by default: a clone there rewrites every file git considers text,
meaning the shaders, .ini, .txt and .dat assets under bios/ arrive with
CRLF and a different hash from the one published. Verification then
fails on files nobody touched.

bios/ and data/ are exempt from normalisation, generated artefacts are
pinned to LF so a Windows checkout does not show them modified, and the
rule order is asserted rather than assumed.

.gitattributes

@@ -0,0 +1,23 @@
+# Source and generated artefacts keep LF on every platform, so a Windows
+# checkout does not show them as modified and the freshness guard keeps
+# meaning something.
+*.json text eol=lf
+*.yml text eol=lf
+*.md text eol=lf
+*.py text eol=lf
+*.sh text eol=lf
+install.ps1 text eol=lf
+
+# Preserved files are bytes, not text, and these rules come last so they win.
+#
+# Without them git guesses. A clone on Windows, where the installer sets
+# core.autocrlf=true by default, rewrites every file git considers text on
+# checkout: shaders, .ini, .txt and .dat assets under bios/ come out with CRLF
+# line endings and a different SHA1 from the one this repository publishes.
+# Verification then fails on files nobody touched, and a re-commit silently
+# changes the bytes of a preserved asset.
+#
+# provenance/ is not listed: those snapshots are generated here, not
+# preserved, so they follow the LF rule above.
+bios/** -text
+data/** -text