Remove git and Git LFS from the container images

[hujc7]

Summary

Isaac Lab's containers stop shipping git and Git LFS — nothing in either runtime image used them,
and their removal clears the three golang.org/x/crypto scanner findings in nvbug 6782864 outright
instead of waiting on an upstream Git LFS release.

Description

docker/scripts/install_git_lfs.sh (added in #7811) installed the upstream Git LFS 3.8.0 binary in
both images. That binary embeds a full Go module manifest, so dependency scanners read
golang.org/x/crypto v0.54.0 out of it and raised GO-2026-6303 / 6354 / 6355. No upstream Git LFS
release carries the fixed x/crypto v0.56.0 yet, so the finding could not be remediated in place.

Neither image needs the pair:

• CI materialises its lfs: true checkout on the runner and bind-mounts the resulting tree in;
  no step then runs git inside the container.
• The git+https:// dependencies (rl-games, robomimic) resolve in the kit-less builder
  stage, which keeps git. Only the runtime stage loses it.
• The version is static — no setuptools_scm — and tools/conftest.py makes no git calls.

Removing only one of the pair is the state that breaks: git-lfs install --system sets
filter.lfs.required=true, so a git without the filter binary fails every call on an LFS tree.
That is the failure the old Dockerfile.kitless comment recorded; the comment now records the
hazard instead of the workaround.

Breaking change

Anything that shells out to git from inside a container now fails, including
isaaclab.utils.assets.retrieve_git_asset_path for remote git asset sources and the benchmark
version recorder. Install git in a derived image, or resolve those paths on the host and mount the
result. Captured in the changelog fragment.

Validation

Built Dockerfile.kitless locally from this branch and checked the image, not the exit code:

Check	Result
git / git-lfs on PATH	both absent
residual filter.lfs.* system config	none
rl_games in the venv (builder resolved its git+ URL)	present
import isaaclab, isaaclab_tasks + gym registry	OK, 48 Isaac- tasks
pytest source/isaaclab/test/utils --collect-only	833 collected, 3 errors

The 3 errors are all ImportError: AppLauncher requires the full Isaac Sim runtime — pre-existing
for a kit-less image, unrelated to this change.

Dockerfile.base was not built locally; CI is its first build.

test_runtime_images_ship_neither_git_nor_git_lfs fails against the unmodified Dockerfiles and
passes with them, and test_kitless_builder_keeps_git_for_vcs_dependencies guards the builder stage
so a later cleanup cannot silently break dependency resolution.

Type of change

• Breaking change (existing functionality will not work without user modification)

Release backport

• Backport this pull request to the active release branch after it merges into develop

Checklist

• I have read and understood the contribution guidelines
• I have run the pre-commit checks with ./isaaclab.sh --format
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• I have added a changelog fragment under source/<pkg>/changelog.d/ for every touched package
• I have added my name to the CONTRIBUTORS.md or my name already exists there

[hujc7]

run-ci

[hujc7]

run-ci