docs: record git-lfs/clang/cmake/ninja install and flag the stale QGIS flatpak

git-lfs 3.7.1 with an active lfs filter, clang 23.1.4, cmake 4.3.0, ninja
1.13.2. The flathub lts branch installed QGIS 3.28.9 on an EOL Qt5 runtime, so
it is recorded as an invalid pin with the replacement path.

Docs/toolchain.md

@@ -15,9 +15,10 @@ Audited 2026-11-06 on the development workstation.
 | Blender | `5.2` LTS (upstream patch `5.2.3`) | Flatpak `org.blender.Blender` | Installed. |
 | MPFB | `2.0.18` (extension `mpfb`, declares Blender >= 4.2) | Blender extensions platform | Installed. Load-and-export check on 5.2 still pending. |
 | Blosm | latest release at install time | blosm.com / Gumroad | Not installed. Version must be recorded before first use. |
-| QGIS | `3.44.15` LTR | qgis.org | Not installed. |
+| QGIS | `3.44.15` LTR targeted; installed flatpak is `3.28.9` | qgis.org / flathub | **Not a valid pin.** The `lts` flatpak branch is 3.28.9 on an end-of-life Qt5 runtime. Replace via `stable` or distrobox, then pin. See [environment.md](environment.md). |
 | Git | `2.56.0` | Bazzite image | Installed. |
-| Git LFS | `3.x` | `rpm-ostree` layer | Not installed. **Required** before committing any file matched by `.gitattributes`. |
+| Git LFS | `3.7.1` | `rpm-ostree` layer | Installed; `git lfs install` run, lfs filter active. |
+| Host build tools | `clang 23.1.4`, `cmake 4.3.0`, `ninja 1.13.2` | `rpm-ostree` layer | Installed. These are host tools, not the engine toolchain. |
 | distrobox | `1.8.2.5` | Bazzite image | Installed. |
 | Python (tooling) | `3.14.8` system | Bazzite image | Installed. Use a venv for geo/tool scripts. |
 | ffmpeg | `8.1.3` | Bazzite image | Installed. |
@@ -35,5 +36,5 @@ Unreal Engine 5.9 is in preview and Unreal Engine 6 has been announced as of Nov
 
 1. **Blosm on Blender 5.2.** Blosm versions historically lag Blender releases. Verify Blosm against the installed Blender 5.2 before the blockout step. If it fails, add a side-by-side Blender 4.5 LTS Flatpak and convert that step's output only; do not mix Blender versions within one asset.
 2. **MPFB 2.0.18 on Blender 5.2.** The extension declares Blender >= 4.2 but predates 5.x. The acceptance test is the `0.1.0` requirement to export one MPFB character with baked materials and a deform skeleton and import it into Unreal.
-3. **QGIS LTR transition.** QGIS 4.4.0 entered LTR on 2026-10-30 but LTR binaries were still `3.44.15` at audit time. Do not pin `4.4.0` until its installers exist; switching LTR later is a documented migration.
+3. **QGIS flatpak tracks a stale LTR.** The flathub `lts` branch is `3.28.9` (2022) on `org.kde.Platform 5.15-21.08`, which is end-of-life. A 2022 QGIS still converts CRS and edits vectors correctly, but its PROJ/GDAL data and processing algorithms are four years behind the current LTR, and the runtime gets no security fixes. Replace it before the geo pipeline depends on it; record whichever version ends up pinned.
 4. **Driver and Vulkan validation on Bazzite.** Not an officially supported Unreal distribution. Validate before asset production, as `ROADMAP.md` requires.