Fix release versioning: keep tree ruff-clean, fail fast on dirty tag builds

The tagged v0.10.6 CI build produced wheels versioned
0.10.7.dev0+g503ce8e49.d20261004: setup.py was not ruff-format-clean, so
release.py's own 'ruff format .' step rewrote it, dirtying the checkout
before setuptools_scm ran. PyPI then rejected the local version segment
with HTTP 400.

- ruff-format setup.py
- release.py: on a v*-tagged HEAD, fail before building if the version
  is not a clean release, printing the dirty files
- add .gitattributes (eol=lf) so Windows checkouts can't dirty the tree
  via normalize_line_endings either

setup.py

@@ -14,8 +14,10 @@ if sys.maxsize <= 2**32:
         "aeg does not support 32-bit platforms; build with a 64-bit Python"
     )
 
-libaegis_static = ROOT / "libaegis/zig-out/lib" / (
-    "aegis.lib" if sys.platform == "win32" else "libaegis.a"
+libaegis_static = (
+    ROOT
+    / "libaegis/zig-out/lib"
+    / ("aegis.lib" if sys.platform == "win32" else "libaegis.a")
 )
 
 ffibuilder = FFI()