Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps the version into bsdaily: the
VERSION build argument when one is given, otherwise `git describe
--tags --always` of the .git in the build context. The build fails if
the context carries .git and no version comes out. bsdaily prints it
with --version.

The new .dockerignore is the canonical copy, which keeps .git/config
out of the build context. script/docker is replaced with the canonical
copy, which passes the version it derives on the host.

Model: opus-5-5

TODO.md

@@ -20,6 +20,9 @@ green with the new lint config.
 
 # Completed Steps
 
+- 2026-10-02: A plain `docker build .` stamps the git tag or short commit
+  into the binary, which `bsdaily --version` prints; added the canonical
+  `.dockerignore`, which keeps `.git/config` out of the build context.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-06-28: Fixed errcheck lint failures; added compilation smoke test;