fix: ship git-lfs in the Docker image

The repo keeps binary assets as Git LFS objects, but the runner stage
installed plain git. Without git-lfs, checkout writes ~130-byte pointer files
in place of the real content and reports a clean tree, so an agent reads a
text stub where an image should be and any `git lfs` subcommand fails. That
is silent corruption of a working checkout, not a visibly missing tool, which
is why it goes in beside git rather than with the optional tooling.

Confirmed in the running container: screenshots/fn-061-medieval-desktop.png
was a `version https://git-lfs.github.com/spec/v1` stub — 129 tracked files
in that state — and became a valid 753KB PNG (signature and IEND intact)
after installing git-lfs and running `git lfs pull`.

The Dockerfile manifest guard now asserts the package so it cannot be dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.changeset/docker-git-lfs.md

@@ -0,0 +1,7 @@
+---
+"@runfusion/fusion": patch
+---
+
+summary: The Docker image now ships git-lfs, so LFS-tracked files check out as real content instead of stubs.
+category: fix
+dev: The repository stores binary assets (screenshots) as Git LFS objects, but the runner stage installed plain `git`. Without git-lfs, `git checkout`/`clone` writes ~130-byte pointer files in place of the real content AND reports a clean tree — an agent reading one gets a text stub where an image should be, and any `git lfs` subcommand fails outright. Verified in the running container: `screenshots/fn-061-medieval-desktop.png` was a `version https://git-lfs.github.com/spec/v1` stub across 129 tracked files, and became a valid 753KB PNG after installing git-lfs and running `git lfs pull`. Added to the runner apt install alongside git, with the Dockerfile manifest guard extended so it cannot be dropped again.

Dockerfile

@@ -77,8 +77,13 @@ ENV PORT=4040
 # FNXC:DockerRun 2026-08-18-06:05: ripgrep ships by default because the coding agents Fusion drives
 # reach for `rg` as their primary search tool; without it they silently degrade to slower/partial
 # fallbacks inside the container while working fine on a developer machine that has it installed.
+# FNXC:DockerRun 2026-08-20-04:30: git-lfs ships by default because this repository stores binary
+# assets (screenshots) as LFS objects. Without it, git silently checks out 130-byte POINTER FILES
+# instead of the real content and reports a clean tree — so an agent reads a text stub where an image
+# should be, and `git lfs` subcommands in any workflow fail outright. It is a git dependency, not an
+# optional extra: the failure is silent corruption of a working checkout, not a missing feature.
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends git ca-certificates ripgrep curl gnupg \
+  && apt-get install -y --no-install-recommends git git-lfs ca-certificates ripgrep curl gnupg \
   && rm -rf /var/lib/apt/lists/*
 
 # FNXC:DockerRun 2026-08-18-06:40: gh, tailscale, and cloudflared ship in the image.

scripts/__tests__/dockerfile-workspace-manifests.test.mjs

@@ -131,6 +131,16 @@ test("runner stage installs ca-certificates alongside git", () => {
     /\bripgrep\b/,
     "runner stage must install ripgrep — the coding agents Fusion drives use `rg` as their primary search tool",
   );
+  /*
+  FNXC:DockerRun 2026-08-20-04:30:
+  Without git-lfs, git checks out 130-byte pointer files in place of LFS-tracked binaries and still
+  reports a clean tree — silent corruption of a working checkout rather than a visibly missing tool.
+  */
+  assert.match(
+    aptInstall,
+    /\bgit-lfs\b/,
+    "runner stage must install git-lfs — LFS-tracked assets otherwise check out as pointer stubs and git reports the tree clean",
+  );
 });
 
 /*