ci: add line-ending check as first verify step

Add a new `line-endings` job to `verify.yml` that runs before any
other verify job via `needs:`. It uses `git ls-files --eol` to check
that every text file in the index is stored as LF, exempting the
`.bat`/`.cmd`/`.ps1` extensions that the `.gitattributes` keeps on
CRLF for Windows compatibility.

The check is redundant with Git's own clean filter (which normalizes
on commit per `.gitattributes: * text=auto eol=lf`) but catches two
gaps:

* A file that Git's `text=auto` heuristic misclassifies as binary
  (e.g., an early null byte) silently keeps whatever line endings it
  was committed with.
* A filter-bypass via `--literally` or a custom hook path.

Making the other three verify jobs (`pmd`, `checkstyle`,
`maven-verify`) depend on this one means a line-ending violation
fails the pipeline within seconds instead of a Maven build later.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: joaodinissf

.github/workflows/verify.yml

@@ -5,6 +5,7 @@ on:
   pull_request:
 jobs:
   pmd:
+    needs: line-endings
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
@@ -17,6 +18,7 @@ jobs:
       - name: PMD Check
         run: mvn pmd:pmd pmd:cpd pmd:check pmd:cpd-check -f ./ddk-parent/pom.xml --batch-mode --fail-at-end
   checkstyle:
+    needs: line-endings
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
@@ -28,7 +30,26 @@ jobs:
         run: echo "WORKSPACE=${{ github.workspace }}" >> $GITHUB_ENV
       - name: Checkstyle Check
         run: mvn checkstyle:checkstyle checkstyle:check -f ./ddk-parent/pom.xml --batch-mode --fail-at-end
+  line-endings:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - name: Check LF line endings in index
+        # .gitattributes declares `* text=auto eol=lf` with .bat/.cmd/.ps1
+        # exempted. Git's clean filter normalizes on commit, but verify it
+        # explicitly in case a file is miscategorized as binary or a filter
+        # is bypassed.
+        run: |
+          violations=$(git ls-files --eol \
+            | grep -E "^i/(crlf|mixed)" \
+            | grep -vE "\.(bat|cmd|ps1)$" || true)
+          if [ -n "$violations" ]; then
+            echo "Files with CRLF/mixed line endings stored in the index:"
+            echo "$violations"
+            exit 1
+          fi
   maven-verify:
+    needs: line-endings
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6