feat: git-lfs as a managed tool (+ fix the 1.13.2 tmux config regression)

[YASoftwareDev]

What

git-lfs becomes a managed tool (apt where available, GitHub binary otherwise, with
an update block and test coverage) — and a regression I shipped in 1.13.2 is
fixed, which this work uncovered.

The 1.13.2 regression (first commit, fix to shipped code)

1.13.2 added if ! has tmux before linking tmux config. has is command -v, and
~/.local/bin is not on PATH while install.sh runs — so on a no-sudo host the
guard fired immediately after _install_tmux had installed tmux there:

✓ tmux installed → ~/.local/bin/tmux (tmux 3.5a)
! tmux not found - skipping tmux config and plugins

Exactly the hosts 1.12.0 exists to serve lost their tmux config. ci-local.sh nosudo-auto caught it: .tmux.conf, .tmux.conf.local and tmux-status-rows all
missing. Both entry points now share a _tmux_present helper that probes the
absolute path as well as PATH — the repo's own standing rule, which 1.13.2 did not
follow. This is live on master and on all 14 fleet hosts, so it wants merging
regardless of the git-lfs half.

git-lfs install

Assets use Debian arch names (git-lfs-linux-amd64-*), not the Rust triples
bat/fd/rg use, so it maps through _deb_arch. That helper moves from
modules/base.sh to lib/utils.sh because update.sh needs it and does not source
that module — caught by ci-local.sh failing with _deb_arch: command not found.

git-lfs config: deliberately NOT git lfs install

Two measured reasons:

• git lfs install writes to the global config, and ~/.gitconfig here is a
  symlink to the tracked git/.gitconfig. It would edit a tracked file and leave
  every host's checkout dirty — which then blocks its own next update, via the same
  clash guard the rollout job uses.
• The filters carry required = true, so shipping them where git-lfs is absent makes
  every LFS checkout fail. Config must follow the tool, not precede it.

So the filters go to ~/.gitconfig.local, exactly as install.sh already writes
zdiff3, and only when the binary is present. A value the user already set is left
alone.

Verified

Clean no-sudo containers:

✓ git-lfs installed → ~/.local/bin/git-lfs (git-lfs/3.8.0)
✓ git-lfs filters set in ~/.gitconfig.local
filter.lfs.clean / smudge / process / required   -> present
git config --get filter.lfs.process              -> git-lfs filter-process
TRACKED git/.gitconfig                           -> clean

Red-proof — installer pointed at a nonexistent repo:

! git-lfs: could not find release URL - skipping
binary present? [NO]
filters written? []        <- correct: no config without the tool

Idempotency — second run: git-lfs filters already configured, filter count
stays 1.

ci-local.sh --ubuntu 24.04 --profile nosudo-auto PASS 1/1;
--profile minimal --skip-nosudo PASS 1/1; test.sh workstation 63/64, 0 failures;
lint-workflows, config-needs-tool, no-fixture-masking, ci-gate-covers-all all PASSED.

Note on my own red-proof

My first attempt at the "unobtainable" arm was invalid — I broke
https://github.com/git-lfs/git-lfs, but the code fetches through
_gh_release_info, which builds an api.github.com URL. git-lfs installed
normally and the arm proved nothing. The corrected arm points the installer at a
nonexistent repo, which does reach the failure path.