fix: treat PID=1 as stale in PID file singleton check, fix govet shadow, add .gitattributes (#2642)

- pid: When a container stops and leaves behind a PID file with PID 1
  on a shared volume, the host's init process (PID 1) passes the
  isProcessRunning check, blocking new gateway starts. Treat recorded
  PID 1 as always stale in both WritePidFile and ReadPidFileWithCheck.
  Added unit tests covering the PID=1 container leftover scenario.

- isolation: Fix govet shadow warning on platform_windows.go line 105
  where := shadows the outer err variable. Changed to = assignment.

- gitattributes: Enforce LF line endings for shell scripts to prevent
  CRLF issues when checking out on Windows (breaks Docker entrypoint).

Co-authored-by: BeaconCat <BeaconCat@users.noreply.github.com>

pkg/pid/pidfile_test.go

@@ -278,6 +278,46 @@ func TestRemovePidFileIfPIDMismatch(t *testing.T) {
 	}
 }
 
+// TestWritePidFileContainerPID1 verifies that a leftover PID file with PID 1
+// (typical container entrypoint) is treated as stale and overwritten.
+func TestWritePidFileContainerPID1(t *testing.T) {
+	dir := tmpDir(t)
+
+	stale := PidFileData{PID: 1, Token: "deadbeef12345678deadbeef12345678"}
+	raw, _ := json.MarshalIndent(stale, "", "  ")
+	os.WriteFile(filepath.Join(dir, pidFileName), raw, 0o600)
+
+	data, err := WritePidFile(dir, "127.0.0.1", 18790)
+	if err != nil {
+		t.Fatalf("WritePidFile should treat PID 1 as stale, got error: %v", err)
+	}
+	if data.PID != os.Getpid() {
+		t.Errorf("PID = %d, want %d", data.PID, os.Getpid())
+	}
+}
+
+// TestReadPidFileWithCheckContainerPID1 verifies that a leftover PID file
+// with PID 1 is treated as stale and cleaned up.
+func TestReadPidFileWithCheckContainerPID1(t *testing.T) {
+	if os.Getpid() == 1 {
+		t.Skip("test not meaningful when running as PID 1")
+	}
+	dir := tmpDir(t)
+
+	stale := PidFileData{PID: 1, Token: "deadbeef12345678deadbeef12345678"}
+	raw, _ := json.MarshalIndent(stale, "", "  ")
+	os.WriteFile(filepath.Join(dir, pidFileName), raw, 0o600)
+
+	data := ReadPidFileWithCheck(dir)
+	if data != nil {
+		t.Error("expected nil for PID 1 leftover")
+	}
+
+	if _, err := os.Stat(filepath.Join(dir, pidFileName)); !os.IsNotExist(err) {
+		t.Error("PID 1 leftover file should be removed")
+	}
+}
+
 // TestReadPidFileUnlockedInvalidJSON returns error for malformed content.
 func TestReadPidFileUnlockedInvalidJSON(t *testing.T) {
 	dir := tmpDir(t)