build: bundle ast-grep engine for all 5 platforms via Git LFS

Fresh clones are now fully self-contained / offline (no first-run fetch needed).
Binaries (linux x64/arm64, darwin x64/arm64, win32 x64) tracked via LFS; verified
against bin/checksums.txt. First-run release fetch kept as a no-lfs fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -1,4 +1,4 @@
-# Engine binaries are gitignored (see .gitignore). If you re-enable committing them
-# and have git-lfs, uncomment to track them with LFS:
-# bin/**/ast-grep filter=lfs diff=lfs merge=lfs -text
-# bin/**/ast-grep.exe filter=lfs diff=lfs merge=lfs -text
+# Engine binaries are large (~50 MB each) and tracked with Git LFS so the repo stays
+# usable while fresh clones are fully self-contained (offline, no first-run fetch).
+bin/**/ast-grep filter=lfs diff=lfs merge=lfs -text
+bin/**/ast-grep.exe filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -1,8 +1,5 @@
-# Bundled engine binaries are large (~50 MB) and platform-specific. They are NOT
-# committed (no git-lfs here); they are fetched on first run or at packaging time.
-# See bin/README.md. The local working tree keeps them so installed skills run offline.
-bin/**/ast-grep
-bin/**/ast-grep.exe
+# Engine binaries ARE committed, via Git LFS (see .gitattributes) — fresh clones are
+# fully self-contained. The compiled Svelte grammar stays local (one-command build).
 grammars/
 
 # Skill runtime output (per-project ledger / reports), never part of the skill.

SKILL.md

@@ -61,8 +61,9 @@ Detect platform and pick the binary; fall back gracefully.
    - Arch: x86_64/amd64→`x64`, arm64/aarch64→`arm64`.
 2. Use `<skill-dir>/bin/<os>-<arch>/ast-grep` (`ast-grep.exe` on Windows). Make it
    executable if needed (`chmod +x` on Unix).
-3. **If that file is missing** (fresh clone — binaries aren't committed), fetch the pinned
-   release once into that dir, then verify against `bin/checksums.txt`:
+3. The binaries are bundled via **git-lfs**, so a normal clone has them. **If the file is
+   an LFS pointer or missing** (lfs not installed / not pulled), run `git lfs pull`, or
+   fetch the pinned release once into that dir and verify against `bin/checksums.txt`:
    the version is in `bin/VERSION`; releases are at
    `https://github.com/ast-grep/ast-grep/releases/download/<VERSION>/app-<triple>.zip`
    (triples: `x86_64-unknown-linux-gnu`, `aarch64-unknown-linux-gnu`,

bin/README.md

@@ -26,13 +26,11 @@ For each platform, download the release archive, extract the `ast-grep` binary i
 the matching `bin/<os>-<arch>/` directory, and record its SHA-256 in `checksums.txt`.
 Pin a single upstream version across all platforms (see `VERSION`).
 
-> Size note: the `ast-grep` binary is ~50 MB per platform. Because of that (and no
-> git-lfs here), the binaries are **gitignored, not committed** (`.gitignore`). The skill
-> is still self-contained *once installed* — the local working tree keeps the binary, so a
-> copied/symlinked skill runs offline. On a **fresh clone**, `SKILL.md` Step 0 fetches the
-> pinned release (`VERSION`) into `bin/<os>-<arch>/` on first use and verifies it against
-> `checksums.txt`. To pre-bundle for distribution instead, commit the binaries with
-> git-lfs (see `.gitattributes`) or ship per-platform packages.
+> Size note: the `ast-grep` binary is ~50 MB per platform (~250 MB total). The binaries
+> are **committed via Git LFS** (`.gitattributes`), so a clone is fully self-contained and
+> offline. After cloning, ensure `git lfs` is installed and run `git lfs pull` if the files
+> are still pointers. As a fallback (no lfs), `SKILL.md` Step 0 fetches the pinned release
+> (`VERSION`) and verifies it against `checksums.txt`.
 
 ## Verification