There's debian packages for git-lfs, but they're binary packages so we'll probably want/need to build it ourselves (hopefully not hard, they did the work).
If it's not too hard, we should just install it everywhere we install git, just for consistency. But at the very least it should be installed on all scap-related hosts (masters & targets)