Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps the version into bsdaily: the
VERSION build argument when one is given, otherwise `git describe
--tags --always` of the .git in the build context. The build fails if
the context carries .git and no version comes out. A host `make` build
stamps the same `git describe` value, or dev when it yields nothing.
bsdaily logs the version on the first line of every run and prints it
with --version.

The new .dockerignore is the canonical copy, which keeps .git/config
out of the build context, plus this repo's host-built artifacts.
script/docker is replaced with the canonical copy, which passes the
version it derives on the host.

Model: opus-5-5

TODO.md

@@ -15,11 +15,15 @@ pre-1.0
 # Next Step
 
 Bring the repo into policy compliance in one commit: add .gitignore,
-.dockerignore, .editorconfig, and .golangci.yml. Verify `make check` stays
-green with the new lint config.
+.editorconfig, and .golangci.yml. Verify `make check` stays green with the new
+lint config.
 
 # Completed Steps
 
+- 2026-10-02: A plain `docker build .` and a host `make` build stamp the git tag
+  or short commit into the binary, which `bsdaily` logs on the first line of
+  every run and prints with `--version`; added the canonical `.dockerignore`,
+  which keeps `.git/config` out of the build context.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-06-28: Fixed errcheck lint failures; added compilation smoke test;
@@ -36,8 +40,7 @@ green with the new lint config.
 
 # Future Steps
 
-- Add .gitignore, .dockerignore, .editorconfig, .golangci.yml (the Next
-  Step).
+- Add .gitignore, .editorconfig, .golangci.yml (the Next Step).
 - Expand tests beyond the compilation smoke test: unit tests for the
   extraction, verification, and atomic-publish paths.
 - Cut a first SemVer release once compliance and test coverage land.