fix: strip CR from container shell scripts in Dockerfile build

.gitattributes pins *.sh to LF, but that only helps after a full working-tree
renormalise, which a Windows build box may not have done. The image build kept
failing at `RUN bash setup-melo.sh` because the checked-out file still had CRLF,
so bash read line 18 as `set -euxo pipefail\r` and aborted with
"set: pipefail: invalid option name".

Strip CR from setup-melo.sh before running it, and normalise all docker/scripts
shell scripts to LF after the app COPY so their shebangs (entrypoint, run-*.sh)
also survive a CRLF checkout. Makes the build EOL-agnostic regardless of host
autocrlf settings.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dockerfile

@@ -63,7 +63,11 @@ RUN ls -d /opt/venv/lib/python*/site-packages/nvidia/cublas/lib \
 #     Heavy layer (torch CPU + transformers + MeCab); placed before the app
 #     COPY so it stays cached across source-only changes. ---
 COPY docker/setup-melo.sh /app/docker/setup-melo.sh
-RUN bash /app/docker/setup-melo.sh
+# Strip CR before running: a Windows checkout (autocrlf) yields CRLF, which makes
+# bash read line 18 as `set -euxo pipefail\r` and abort with
+# "set: pipefail: invalid option name". .gitattributes pins *.sh to LF, but this
+# keeps the build working even on a not-yet-renormalised working tree.
+RUN sed -i 's/\r$//' /app/docker/setup-melo.sh && bash /app/docker/setup-melo.sh
 
 # --- Human input + window management for the on-screen Chrome control tool.
 #     Placed AFTER the heavy melo layer so it doesn't bust that cache. xdotool
@@ -81,6 +85,11 @@ RUN cd /app/bot && bun install --frozen-lockfile || bun install
 COPY . /app
 WORKDIR /app
 
+# Normalise all container shell scripts to LF. On a Windows checkout (autocrlf)
+# these arrive as CRLF, which would break their shebangs at runtime (entrypoint,
+# run-*.sh) the same way it broke setup-melo.sh at build time.
+RUN find /app/docker /app/scripts -name '*.sh' -exec sed -i 's/\r$//' {} +
+
 # --- Default Piper voice (best-effort at build; entrypoint retries if absent) ---
 RUN bash docker/download-piper.sh || true