fix(sops): normalize .sops.yaml to LF — committed blob had CRLF

The committed blob contained CRLF line endings (6 CRLF / 199 bytes)
even though .gitattributes declares '* text=auto eol=lf'. The
working-tree copy matched the blob, so git reported it clean, but
wsl/github-run raw reads leaked \r into check #7's sops path_regex
extraction → '.ci/checks.sh' FAIL.

Normalized to LF (byte-identical content otherwise): aligns with
eol=lf policy, checks #7 passes locally and in CI.

.sops.yaml

@@ -1,7 +1,7 @@
-keys:
-  - &default age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
-creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
-    key_groups:
-    - age:
+keys:
+  - &default age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
       - *default