fix: allow PowerShell CRLF line endings

.superpowers/sdd/2026-08-04-unified-compose-deployment/task-1-report.md

@@ -74,3 +74,61 @@ Task implementation: `ad07a75` (`build: enforce portable line endings`)
 None. The prescribed verifier and repository-integrity checks pass. A full Docker image build was
 not run because this task's required validation is the shell verifier suite; the Dockerfile change
 is structurally covered by the reviewed build instruction ordering.
+
+## Fix round 1 — PowerShell CRLF policy
+
+### Status
+
+Complete. The verifier now applies the `.gitattributes` PowerShell exception: `*.ps1` files may
+use CRLF, while CRLF remains a violation for the shell, YAML, and Dockerfile fixture inputs.
+
+### Changed files
+
+- `scripts/verify-line-endings.sh` — skips `.ps1` files before the CRLF rejection check.
+- `scripts/test-verify-line-endings.sh` — adds a CRLF `valid.ps1` fixture and asserts it is not
+  reported; the fixture remains CRLF during the succeeding final verifier invocation.
+
+### Red / green evidence
+
+#### RED
+
+Before the verifier change:
+
+```text
+$ bash scripts/test-verify-line-endings.sh
+reported compliant CRLF PowerShell path: valid.ps1
+```
+
+The failure proves the new regression test exercised the existing incorrect behavior.
+
+#### GREEN
+
+After adding the `.ps1` exception:
+
+```text
+$ bash scripts/test-verify-line-endings.sh
+line-ending verifier tests passed
+```
+
+The existing assertions still require `bad.sh`, `compose.yaml`, and `Dockerfile` to be reported,
+while `valid.ps1` is rejected only if it is incorrectly reported. The final fixture verification
+passes with `valid.ps1` still in CRLF form.
+
+### Command and output summary
+
+| Command | Result |
+| --- | --- |
+| `bash scripts/test-verify-line-endings.sh` (before change) | Exit 1: `reported compliant CRLF PowerShell path: valid.ps1`. |
+| `bash scripts/test-verify-line-endings.sh` | Passed: `line-ending verifier tests passed`. |
+| `bash scripts/verify-line-endings.sh` | Passed (exit 0; no output) for tracked repository files. |
+| `git diff --check` | Passed (exit 0; no output). |
+
+### Scope and self-review
+
+The change is limited to the Important finding. It matches the existing lowercase `*.ps1`
+pattern in `.gitattributes`, leaves the CRLF detection for every other file untouched, and does
+not address either deferred Minor finding.
+
+### Concerns
+
+None.

scripts/test-verify-line-endings.sh

@@ -9,6 +9,7 @@ printf '#!/bin/sh\nexit 0\n' > "$fixture_root/ok.sh"
 printf '#!/bin/sh\r\nexit 0\r\n' > "$fixture_root/bad.sh"
 printf 'services:\r\n  app:\r\n    image: example\r\n' > "$fixture_root/compose.yaml"
 printf 'FROM scratch\r\n' > "$fixture_root/Dockerfile"
+printf 'Write-Output "ok"\r\n' > "$fixture_root/valid.ps1"
 
 set +e
 output="$("$repo_root/scripts/verify-line-endings.sh" "$fixture_root" 2>&1)"
@@ -32,6 +33,11 @@ if grep -Fq 'ok.sh' <<< "$output"; then
   exit 1
 fi
 
+if grep -Fq 'valid.ps1' <<< "$output"; then
+  echo "reported compliant CRLF PowerShell path: valid.ps1" >&2
+  exit 1
+fi
+
 printf '#!/bin/sh\nexit 0\n' > "$fixture_root/bad.sh"
 printf 'services:\n  app:\n    image: example\n' > "$fixture_root/compose.yaml"
 printf 'FROM scratch\n' > "$fixture_root/Dockerfile"

scripts/verify-line-endings.sh

@@ -23,6 +23,10 @@ root="$(cd "$root" && pwd)"
 offenders=()
 
 while IFS= read -r -d '' file; do
+  case "$file" in
+    *.ps1) continue ;;
+  esac
+
   if LC_ALL=C grep -Il $'\r' "$file" >/dev/null; then
     offenders+=("${file#"$root"/}")
   fi