fix(ci): binary-safe encoding guard + best-practice .gitattributes

.gitattributes

@@ -1,4 +1,23 @@
-# Normalize line endings to LF in the repo. Prevents the CRLF churn that shows
-# up on Windows clones and stops CP-1252 control bytes (e.g. 0x97 em-dash) from
-# silently breaking UTF-8 tools like zizmor.
+# Line-ending + binary policy.
+# text=auto detects text and normalizes it to LF in the repo (kills the CRLF
+# churn that shows up on Windows clones); explicit eol for scripts that need a
+# fixed ending; binary markers so git never line-ending-munges non-text files.
+# Refs: https://git-scm.com/docs/gitattributes
+#       https://docs.github.com/en/get-started/git-basics/configuring-git-to-handle-line-endings
 * text=auto eol=lf
+
+# Windows scripts must keep CRLF (cmd.exe).
+*.bat  text eol=crlf
+*.cmd  text eol=crlf
+
+# Binary — never normalize.
+*.png   binary
+*.jpg   binary
+*.jpeg  binary
+*.gif   binary
+*.ico   binary
+*.webp  binary
+*.woff  binary
+*.woff2 binary
+*.pdf   binary
+*.zip   binary

.github/workflows/encoding-guard.yml

@@ -19,21 +19,25 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
-      - name: Validate UTF-8 (catches CP-1252 0x97 that silently breaks zizmor)
+      - name: Validate UTF-8 (binary-safe; catches CP-1252 0x97 that breaks zizmor)
         run: |
           python3 - <<'PY'
           import pathlib, sys
           bad = []
           for p in pathlib.Path(".github").rglob("*"):
-              if p.is_file():
-                  try:
-                      p.read_bytes().decode("utf-8")
-                  except UnicodeDecodeError as e:
-                      bad.append(f"{p}: {e}")
+              if not p.is_file():
+                  continue
+              data = p.read_bytes()
+              if b"\x00" in data:        # binary file (git's own heuristic) -> skip
+                  continue
+              try:
+                  data.decode("utf-8")
+              except UnicodeDecodeError as e:
+                  bad.append(f"{p}: {e}")
           if bad:
               print("::error::Invalid UTF-8 (e.g. CP-1252 0x97) found in .github/:")
               for b in bad:
                   print("  " + b)
               sys.exit(1)
-          print("OK: all .github files are valid UTF-8.")
+          print("OK: all text files in .github/ are valid UTF-8.")
           PY