fix: preserve immutable fixture bytes on Windows checkout

[2233admin]

Summary

• Preserve immutable capture bytes with the narrowly scoped .gitattributes rule projects/fixtures/** -text.
• Add a real-Git regression for both core.autocrlf=true and false, all 20 raw and 3 stream payloads through production loaders, and RealCandidatePreflightDesk.
• Include an attribute-less checkout that fails the existing raw-hash verifier. Isolate temporary Git subprocesses from user configuration and Git routing environment.

No fixture payload, metadata, expected hash, verifier behavior, source pin, dependency, or lockfile is changed.

Reproduction

With core.autocrlf=true, a clean Windows checkout of d6c9447cab29898a6eb5fa06be3598b8474cc02f changes 10 of 23 payloads while Git still reports a clean tree. For example, projects/fixtures/polymarket-global/2026-07-31/polymarket-trump-out-2027.json grows from 7473 to 7474 bytes. The committed SHA-256 is e15a8399332c4596ca8e739c35d2734433b3494f7b01a678df1c02c091426b48; the converted checkout hashes to 73d71d76d3506ce0c797ab9807e6f9ffdb3775628305447db5d4ad1dd57c5b3e.

The integrity check correctly rejects those bytes. The error propagates through real-candidate preflight and prevents the Studio control plane from starting. This fixes the checkout boundary, not the verifier: no normalization or hash-check bypass.

Verification

Final reviewed head: da0b0f71bb4d92508780be894de294c042696ab8.

• Independent same-commit verification: PASS. Real fresh clones preserve all 46 fixture/metadata files byte-for-byte against committed blobs in both autocrlf modes; all 23 metadata hash/length pairs bind to original payloads.
• Negative control without the attribute rule: autocrlf=true changes 33/46 files and the production loader rejects the payload; autocrlf=false preserves them.
• pnpm.cmd --filter @pmh/control-plane exec vitest run test/real-candidate-preflight.test.ts: 2/2 pass, including under hostile global signing configuration and inherited Git routing/config injection.
• pnpm.cmd --filter @pmh/evidence exec vitest run test/fixture-corpus.test.ts: 2/2 pass. Owning control-plane/evidence typechecks and whitespace check pass.
• Coordinator ran the actual built control plane at final HEAD with isolated temporary SQLite and loopback ports: /health and /api/v1/readiness both returned HTTP 200 / READY; provider requests and model invocations remained 0, and external/value-moving write authority remained false. The owned process and temporary SQLite files were removed afterward.

Broader suites — not green

The broader suites ran on first commit 529ddba; the follow-up commit only isolates the new test's Git subprocess environment and was independently reverified.

• pnpm.cmd test: root Node test stage reported 21 passed / 7 failed, with spawn pnpm ENOENT on this Windows host. Its first-stage failure prevented the recursive stage from running.
• pnpm.cmd -r test was run separately. All 18 packages with test scripts produced results; five failures were reported in control-plane: four fake-Codex executable ENOENT cases and one PDF-fetch timeout. The new fixture regression passed in that run. These failures are disclosed, not suppressed or counted as a green full suite.

Deployment boundary

This PR does not move a published tag or the parent application's pinned source commit, and it does not modify an existing deployed workspace. Existing converted checkouts need separate canonical-byte restoration; future initialization needs a released/pinned revision containing this protection.

[2233admin]

Deployment validation update: the 10 newline-converted payloads were restored from the pinned source blobs, with a guard refusing any bytes other than the exact expected checkout conversion. All 20 raw and 3 stream payloads now pass the production loaders, and RealCandidatePreflightDesk.load succeeds. The exact reviewed .gitattributes blob (6a6270637e31a08e4bd527a83c7637d28e91b153) was applied as a local patch to the existing workspace; source pin, dependency lockfile, Git configuration/index, and user sessions were preserved. Studio supervision now reaches ready. Actual browser acceptance found a separate OpenAlice LAN ingress limitation: the iframe advertises a client-loopback .localhost origin and an unexposed backend port. That access-chain defect is being repaired separately; this PR does not claim the browser route is already usable or that its commits have been merged/released.