Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps the version into bsdaily: the
VERSION build argument when one is given, otherwise `git describe
--tags --always` of the .git in the build context. The build fails if
the context carries .git and no version comes out. A host `make` build
stamps the same `git describe` value, or dev when it yields nothing.
bsdaily logs the version on the first line of every run and prints it
with --version.

The new .dockerignore is the canonical copy, which keeps .git/config
out of the build context, plus this repo's host-built artifacts.
script/docker is replaced with the canonical copy, which passes the
version it derives on the host.

Model: opus-5-5

Dockerfile

@@ -24,10 +24,9 @@ FROM golang:1.26.4-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af01
 # Depend on lint stage passing
 COPY --from=lint /src/go.sum /dev/null
 
-ARG VERSION=dev
-
-# Install build deps plus the sqlite3 and zstd CLIs the tests/tool shell out to
-RUN apk add --no-cache make build-base sqlite zstd
+# Install build deps plus the sqlite3 and zstd CLIs the tests/tool shell out
+# to, and git, which the build step below derives the version with
+RUN apk add --no-cache make build-base sqlite zstd git
 
 WORKDIR /src
 
@@ -41,8 +40,22 @@ COPY . .
 # Run tests
 RUN make test
 
-# Build (pure Go, no CGO required since we use modernc.org/sqlite)
-RUN CGO_ENABLED=0 go build -o /bsdaily ./cmd/bsdaily
+# Build (pure Go, no CGO required since we use modernc.org/sqlite).
+# The version stamped into the binary: the VERSION build argument when one is
+# given, otherwise `git describe --tags --always` of the .git the build context
+# carries: the tag on a tagged commit, tag-N-gHASH on a commit after one, the
+# short commit when no tag is reachable. A context that carries .git and still
+# yields no version fails the build. With neither, as from a source tarball,
+# the binary reports dev.
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "no version could be derived although the build context carries .git" >&2; \
+        exit 1; \
+    fi; \
+    CGO_ENABLED=0 go build -ldflags="-X main.Version=${version:-dev}" \
+        -o /bsdaily ./cmd/bsdaily
 
 # Runtime stage
 # alpine:3.21