Move review TSVs to LFS and guard large Git blobs

[anotherjulien]

The review campaign left 55 TSV tables (243,541,953 payload bytes) in ordinary Git storage. This converts their current versions to Git LFS and prevents new oversized ordinary blobs without rewriting history or moving/deleting release tags.

All 55 paths, payload lengths and SHA-256 hashes match their original committed bytes at d166b48884d396d61debc5aaa5a1822d27d41bc1. Large TSV deletion counts in the diff represent pointer conversion; the hydrated evidence tables are unchanged. The KB, source material, Device definitions and evidence-package subtrees are identical to main.

Storage guard

• Reject ordinary Git blobs larger than 5 MiB, checking the staged index locally and committed trees in CI.
• Require canonical LFS pointers for every review TSV, including future nested tables.
• Inspect new objects across the PR/push history range so adding and later deleting a large blob still fails.
• Retain nine existing large KB files through exact path/blob exceptions in the reviewed baseline. Changed bytes or another path are not exempt; baseline edits are policy changes. These files are not migrated in this bounded PR.
• Add the Git storage policy CI job and document local use, hydration and required-check configuration. The guard reads Git objects without downloading LFS payloads.

Historical ordinary blobs remain reachable. This is one normal descendant commit, not a storage purge. Existing release tags retain their exact object IDs.

Validation

Passed locally: 11 real-Git storage regression tests; original-byte/hash/length and staged-pointer comparisons for all 55 tables; Git LFS object/pointer integrity; all four evidence packages and 55 evidence acceptance tests; privacy across 21 generated artifacts and metadata surfaces; ESG and ECV with zero objective failures; the 807-artifact inventory; and the full exact-commit canonical-source, private-catalogue and Device gate. All 55 new LFS objects uploaded successfully. All six PR checks passed on the exact candidate. Completed logs confirm 222 KB unit tests, eight schema tests, 12 catalogue-status regressions, 11 storage tests, generated-output freshness and the complete deterministic integrity/claim/privacy gate, plus 55 evidence acceptance tests and the source/compliance checks. See full KB validation and compliance and storage validation. The PR remains open and mergeable; existing main and release-tag references were rechecked unchanged.

Candidate: 08ea0c7821dcfa083d8c6ad7c173e32d7b7189ab. No merge or new release is part of this task.