Make dependency lock checks line-ending independent

[bifrost0x]

What changed

• compare generated Python locks as normalized UTF-8 text instead of raw bytes
• keep every dependency, marker, and hash difference strict while treating CRLF and LF as equivalent
• add a regression policy test for cross-platform checkout line endings

Root cause

Git may check out text files with CRLF on Windows, while uv emits LF. The previous byte comparison therefore reported identical locks as stale on a fresh Windows checkout.

Validation

• dependency lock check passed with uv 0.10.9
• 30 dependency policy tests passed
• git diff --check passed