ci(workspace): guard against raw blobs that should be git lfs

.github/workflows/ci.yml

@@ -48,3 +48,32 @@ jobs:
           unzip -q selene.zip
           chmod +x selene
           ./selene assets/scripts/ mods/
+
+  lfs-guard:
+    name: LFS Pointer Guard
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout without smudging LFS content so the committed git objects can be inspected directly; a raw-committed binary is only distinguishable from a proper pointer at the object level, not in a smudged working tree.
+      - uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Verify LFS-tracked files are stored as pointers
+        run: |
+          # Every tracked path whose .gitattributes filter resolves to lfs must be committed as an LFS pointer. A binary committed in its place (e.g. by a contributor without git-lfs installed) is the failure this guard catches.
+          should_be_lfs=$(git ls-files | git check-attr --stdin filter | sed -n 's/: filter: lfs$//p')
+          violations=""
+          while IFS= read -r f; do
+            [ -z "$f" ] && continue
+            first_line=$(git cat-file -p "HEAD:$f" | head -n1)
+            if [ "$first_line" != "version https://git-lfs.github.com/spec/v1" ]; then
+              violations="$violations $f"
+            fi
+          done <<< "$should_be_lfs"
+          if [ -n "$violations" ]; then
+            echo "::error::Files match an LFS pattern in .gitattributes but were committed as raw blobs instead of Git LFS pointers:"
+            for f in $violations; do echo "  - $f"; done
+            echo "Fix: install git-lfs, run 'git lfs install', then 're-add' each file with 'git add --renormalize <file>' and recommit."
+            exit 1
+          fi
+          echo "All LFS-tracked files are stored as pointers."