test: add container test suites and run them in CI

The repository had no tests: CI only built the image, and the old
container-structure-test setup was parked as config-broken.yml /
docker-compose.test.broken.yml. This adds suites that actually run the image.

- test/compat.sh: backup, restore, forget, check, hooks, failure handling and
  timezone behaviour against the default configuration. These describe what
  users depend on today, so a change that turns them red is a breaking change.
- test/features.sh: optional features, each guarded by a detection check
  against the built image. Absent features are reported as SKIP, so open pull
  requests do not turn master red, and their feature tests start running by
  themselves once the pull request is rebased. Covers #109 (RESTIC_STREAM),
  #99 (docker cli, bash) and #84 (msmtp).
- test/required-features.txt: once a feature is merged its gate is listed here
  and a missing feature becomes a failure instead of a skip.
- test/structure.yml: revived image layout checks, falls back to the official
  container-structure-test image when the tool is not installed.
- test/run.sh --sabotage: breaks the backup call on a throwaway copy of the
  tree and expects the suite to fail, so the tests cannot be watered down into
  always passing. CI runs this as its own step.
- .github/workflows/test.yml: shellcheck plus all suites on every pull request.

Also adds .gitattributes pinning shell scripts, the Dockerfile and YAML to LF.
With a Windows checkout (core.autocrlf=true) the scripts were checked out with
CRLF, and the resulting image failed to start with
"exec /entry.sh: no such file or directory".

No runtime file is touched, the image itself is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Agent-Id: agent-7034f75b-1ddc-4aa1-a4ea-3a54b340e8d9

test/structure.yml

@@ -0,0 +1,64 @@
+schemaVersion: '2.0.0'
+
+# Structural contract of the image. Everything asserted here is something a
+# user can reach from outside: a binary they call from a hook, a path they
+# mount, or the way the container is started.
+
+commandTests:
+  - name: 'restic is installed'
+    command: 'restic'
+    args: ['version']
+    expectedOutput: ['restic \d+\.\d+\.\d+.*']
+  - name: 'rclone is installed'
+    command: 'rclone'
+    args: ['--version']
+    expectedOutput: ['rclone v.*']
+  - name: 'curl is installed, used for Teams notifications'
+    command: 'curl'
+    args: ['--version']
+    expectedOutput: ['curl \d+\..*']
+  - name: 'mail is installed, used for mail notifications'
+    command: 'sh'
+    args: ['-c', 'command -v mail']
+    expectedOutput: ['/usr/bin/mail']
+  - name: 'crond is available'
+    command: 'sh'
+    args: ['-c', 'command -v crond']
+    expectedOutput: ['/usr/sbin/crond']
+  - name: 'flock is available, the cron jobs depend on it'
+    command: 'sh'
+    args: ['-c', 'test -x /usr/bin/flock && echo ok']
+    expectedOutput: ['ok']
+
+fileExistenceTests:
+  - name: 'backup script'
+    path: '/bin/backup'
+    shouldExist: true
+    permissions: '-rwxr-xr-x'
+  - name: 'check script'
+    path: '/bin/check'
+    shouldExist: true
+    permissions: '-rwxr-xr-x'
+  - name: 'entrypoint'
+    path: '/entry.sh'
+    shouldExist: true
+    permissions: '-rwxr-xr-x'
+  - name: 'default repository mount point'
+    path: '/mnt/restic'
+    shouldExist: true
+  - name: 'cron log file'
+    path: '/var/log/cron.log'
+    shouldExist: true
+  - name: 'crontab directory'
+    path: '/var/spool/cron/crontabs'
+    shouldExist: true
+
+metadataTest:
+  volumes: ['/data']
+  entrypoint: ['/entry.sh']
+  cmd: ['tail', '-fn0', '/var/log/cron.log']
+  envVars:
+    - key: 'RESTIC_REPOSITORY'
+      value: '/mnt/restic'
+    - key: 'BACKUP_CRON'
+      value: '0 */6 * * *'