Anchor the .gitattributes entries to the repo root

Copilot: the six entries were unanchored basename patterns, so git applied
them at any depth. Measured before the fix:

  some/deep/dir/.pylintrc     text: set
  .codex/skills/ruleset.xml   text: set
  sub/.bandit                 text: set

That directly contradicts this PR's own claim -- "no pattern, so no file
outside the named six can be affected." A .gitattributes pattern with no
slash is a basename match, exactly like .gitignore. Which is the same trap
I documented in #953 one PR earlier, in the other direction.

Each entry now carries a leading slash. Verified after:

  root .bandit/.pylintrc/.remarkrc/.shellcheckrc/.stylelintrc/ruleset.xml
                              text: set          (unchanged)
  some/deep/dir/.pylintrc     text: unspecified  (was: set)
  .codex/skills/ruleset.xml   text: unspecified  (was: set)
  sub/.bandit                 text: unspecified  (was: set)
  RSS.xml                     text: unspecified  (unchanged)

The comment now explains the anchoring alongside the `*.xml` note, since
the two traps have the same root cause: git pattern matching is
path-anchored only when the pattern contains a slash.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EBV6TkrwsZhcwkh1b6NUHs

Author: claude

.gitattributes

@@ -114,11 +114,15 @@
 # set; anything unspecified is skipped and counted as a gap. Without these,
 # the configs added in #950 join that bucket.
 #
+# Leading slashes anchor these to the repo root. Without one, a .gitattributes
+# pattern with no slash is a BASENAME match at any depth -- the same rule as
+# .gitignore -- so a bare `.pylintrc` would also claim any nested one.
+#
 # NOT `*.xml`: RSS.xml is committed with CRLF, and a blanket `text eol=lf`
 # would rewrite its line endings as a side effect of declaring a config file.
-.bandit text eol=lf
-.pylintrc text eol=lf
-.remarkrc text eol=lf
-.shellcheckrc text eol=lf
-.stylelintrc text eol=lf
-ruleset.xml text eol=lf
+/.bandit text eol=lf
+/.pylintrc text eol=lf
+/.remarkrc text eol=lf
+/.shellcheckrc text eol=lf
+/.stylelintrc text eol=lf
+/ruleset.xml text eol=lf