Report the version: docker build . stamps the git tag or short commit (closes #7)

attrsum --version now prints the git tag or short commit. make build
stamps it with -X from git describe, and the Dockerfile takes the VERSION
build argument when given, otherwise git describe --tags --always on the
.git in the build context, failing if .git is present and no version
comes out. A new .dockerignore, the canonical one, keeps .git/config out
of the context, and also this repo's host-built /attrsum. CI checks out
full history so it sees the 1.0.0 tag and stamps what a full clone does.
script/docker is replaced with the canonical copy.

Model: opus-5-5

.dockerignore

@@ -58,3 +58,6 @@
 **/.idea
 **/.vscode
 **/*.sublime-*
+
+# This repo's host-built binary (`make build`); the image builds its own.
+/attrsum

.gitea/workflows/check.yml

@@ -6,4 +6,8 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-28
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # Full history and tags, so the build stamps the same
+              # `git describe` version as a full clone.
+              with:
+                  fetch-depth: 0
             - run: script/cibuild

TODO.md

@@ -28,7 +28,9 @@ $(HOME)/Documents/_SYSADMIN/cyberdyne path.
 
 * 2026-10-02: `attrsum --version` reports the git tag or short commit,
     stamped by `make build` and by a plain `docker build .` of a clone;
-    `.dockerignore` sends `.git` without `.git/config`
+    `.dockerignore` sends `.git` without `.git/config` and keeps a
+    host-built `attrsum` out; CI checks out full history so it stamps
+    the same version
 * 2026-02-02: correctness pass: track actual bytes read instead of
     stale file size, atomic failure tracking in ProcessCheck, detect
     file modification during checksum (TOCTOU), propagate countFiles