fix: ship git-lfs in the Docker image

The repo keeps binary assets as Git LFS objects, but the runner stage
installed plain git. Without git-lfs, checkout writes ~130-byte pointer files
in place of the real content and reports a clean tree, so an agent reads a
text stub where an image should be and any `git lfs` subcommand fails. That
is silent corruption of a working checkout, not a visibly missing tool, which
is why it goes in beside git rather than with the optional tooling.

Confirmed in the running container: screenshots/fn-061-medieval-desktop.png
was a `version https://git-lfs.github.com/spec/v1` stub — 129 tracked files
in that state — and became a valid 753KB PNG (signature and IEND intact)
after installing git-lfs and running `git lfs pull`.

The Dockerfile manifest guard now asserts the package so it cannot be dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/__tests__/dockerfile-workspace-manifests.test.mjs

@@ -131,6 +131,16 @@ test("runner stage installs ca-certificates alongside git", () => {
     /\bripgrep\b/,
     "runner stage must install ripgrep — the coding agents Fusion drives use `rg` as their primary search tool",
   );
+  /*
+  FNXC:DockerRun 2026-08-20-04:30:
+  Without git-lfs, git checks out 130-byte pointer files in place of LFS-tracked binaries and still
+  reports a clean tree — silent corruption of a working checkout rather than a visibly missing tool.
+  */
+  assert.match(
+    aptInstall,
+    /\bgit-lfs\b/,
+    "runner stage must install git-lfs — LFS-tracked assets otherwise check out as pointer stubs and git reports the tree clean",
+  );
 });
 
 /*