Report the version: docker build . stamps the git tag or short commit (closes #7)

attrsum --version now prints the git tag or short commit. make build
stamps it with -X from git describe, and the Dockerfile takes the VERSION
build argument when given, otherwise git describe --tags --always on the
.git in the build context, failing if .git is present and no version
comes out. A new .dockerignore, the canonical one, keeps .git/config out
of the context, and also this repo's host-built /attrsum. CI checks out
full history so it sees the 1.0.0 tag and stamps what a full clone does.
script/docker is replaced with the canonical copy.

Model: opus-5-5

Dockerfile

@@ -40,7 +40,7 @@ ARG VERSION
 RUN version="${VERSION:-$(git describe --tags --always)}"; \
     if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
         [ "$version" = unknown ]; }; then \
-        echo "no version could be derived although the build context carries .git" >&2; \
+        echo "version is '$version' although .git is present" >&2; \
         exit 1; \
     fi; \
     make build VERSION="${version:-dev}"

TODO.md

@@ -44,8 +44,6 @@ $(HOME)/Documents/_SYSADMIN/cyberdyne path.
 
 # Future Steps
 
-* Add Dockerfile and .dockerignore that run make check, images pinned
-    by sha256, plus a Makefile docker target
 * Add .gitea/workflows/check.yml
 * Restructure README.md into the standard sections: Description,
     Getting Started, Rationale, Design, TODO, License, Author (Getting