[K3s] Emit LF line endings in generated helm/kubectl scripts (fixes Windows-only busybox syntax error)

[henrikroschmann]

Closes #1550

BuildHelmScript and BuildManifestScript compose their scripts with
StringBuilder.AppendLine, which appends Environment.NewLine — \r\n on Windows. The
scripts are injected into Linux containers and executed by busybox ash, which does not
strip the trailing CR, so if [ ... ]; then is tokenized as then\r. The if is never
closed and the script dies at EOF with
syntax error: unexpected end of file (expecting "then").

This makes AddHelmRelease fail 100% of the time on Windows hosts, and AddK8sManifest
carries the identical defect — it just escapes notice because the helm release fails first
in the sample AppHost. Both are fixed here.

Changes

• New K3sShellScript.AppendShellLine — appends a hard \n, with XML docs explaining
  the busybox failure it exists to prevent.
• K3sBuilderExtensions.Helm.cs — 12 call sites switched off AppendLine.
• K3sBuilderExtensions.Manifest.cs — 22 call sites switched off AppendLine.
• Regression tests asserting the generated scripts contain no \r:
  BuildHelmScriptUsesLfLineEndingsOnly, BuildManifestScriptUsesLfLineEndingsOnly.

I used a helper rather than normalizing the finished string with
sb.ToString().Replace("\r\n", "\n"), because the replace would also rewrite CRLF inside
caller-supplied data — a WithHelmValue value, a repo URL, a release name — on its way
into helm --set. The helper only controls terminators the generator itself emits and
leaves caller data byte-exact.

Not affected, for reviewers wondering why the cluster comes up healthy while the helm
container dies: K3sInitEntrypointScript is a C# raw string literal, and Roslyn
normalizes line endings inside those to \n regardless of the source file's endings.

PR Checklist

• Created a feature/dev branch in your fork (vs. submitting directly from a commit on main)
• Based off latest main branch of toolkit
• PR doesn't include merge commits (always rebase on top of our main, if needed)
• Tests for the changes have been added (for bug fixes / features) (if applicable)
• Contains NO breaking changes
• Every new API (including internal ones) has full XML docs
• Code follows all style conventions

Other information

The new regression tests fail on Windows without the fix and are trivially green on Linux —
which is correct, the invariant is the same on every host. Since CI runs on Linux, they
guard the intent rather than reproduce the failure there.

Verified on Windows 11 ARM64 / Docker 29.7.2 by running the actual generated scripts in
the real images against a live rancher/k3s:v1.36.0-k3s1 cluster:

Script	Image	Result
pre-fix bytes, reproduced exactly	alpine/helm:3.18.0	syntax error: unexpected end of file (expecting "then"), exit 2
fixed helm script	alpine/helm:3.18.0	STATUS: deployed, exit 0 — podinfo pod Running
fixed manifest script, plain YAML	alpine/kubectl:1.36.0	configmap/app-config serverside-applied, exit 0
fixed manifest script, kustomize	alpine/kubectl:1.36.0	Detected kustomization, configmap/monitoring-config serverside-applied, exit 0

[henrikroschmann]

@dotnet-policy-service agree