fix: Windows binaries panicked on every scan; test on Windows in CI - #46

A checkout with git's autocrlf default on Windows converted the committed
rule documents to CRLF, so the byte sequence locating the rules list in
the embedded pack never matched and every scan panicked. Every published
Windows binary was affected.

Force LF for all text files via .gitattributes, and normalize the
embedded documents before the pack is assembled so a converted checkout
still builds a working binary.

exclusion_under compared a canonicalized scan root against a raw
fallback spelling whenever the cache directory did not exist yet. On
Windows the two spellings (verbatim long form vs 8.3 short names) never
share a prefix, so the exclusion silently vanished and a scan with
--cache-dir inside the root walked its own cache. Paths that do not
exist now resolve through their nearest existing ancestor.

Silo and rule path globs are matched against forward-slash relative
paths on every platform, so their syntax is now pinned: backslash
escapes everywhere, instead of globset's Windows default of treating it
as a separator.

Test fixtures: the foreign-salt test copies the salt by read and write
because fs::copy cannot copy attributes onto an NTFS alternate data
stream, and the global-excludes fixture writes its gitconfig path with
forward slashes because git config treats backslash as an escape.

The ignore crate expands every tilde in a configured excludesFile path
to the home directory, not only a leading one. Windows temp paths carry
8.3 short names like RUNNER~1, which that expansion corrupts into a
path that opens nothing. The fixture now uses the canonical spelling,
which carries no tilde.