Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps the version into bsdaily: the
VERSION build argument when one is given, otherwise `git describe
--tags --always` of the .git in the build context. The build fails if
the context carries .git and no version comes out. A host `make` build
stamps the same `git describe` value, or dev when it yields nothing.
bsdaily logs the version on the first line of every run and prints it
with --version.

The new .dockerignore is the canonical copy, which keeps .git/config
out of the build context, plus this repo's host-built artifacts.
script/docker is replaced with the canonical copy, which passes the
version it derives on the host.

Model: opus-5-5

Makefile

@@ -1,7 +1,8 @@
 .PHONY: all bootstrap setup check test lint fmt fmt-check build clean deps test-coverage test-integration install release release-snapshot docker hooks
 
-# Version number
-VERSION := 0.1.0-dev
+# Stamped into the binary: the same `git describe` the Dockerfile runs, so a
+# host build reports the same version as the image; dev when it yields nothing.
+VERSION ?= $(shell git describe --tags --always)
 
 # Default target
 all: bsdaily
@@ -36,7 +37,7 @@ lint:
 
 # Build binary (pure Go; no CGO required since we use modernc.org/sqlite).
 bsdaily: internal/*/*.go cmd/bsdaily/*.go
-	CGO_ENABLED=0 go build -o $@ ./cmd/bsdaily
+	CGO_ENABLED=0 go build -ldflags "-X main.Version=$(or $(VERSION),dev)" -o $@ ./cmd/bsdaily
 
 # Clean build artifacts.
 clean: