Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps bsdaily's version: the VERSION
build argument when one is given, otherwise `git describe --tags
--always` on the .git in the build context, as the canonical
Dockerfile does. The build fails if .git is there and the version
still comes out empty, dev or unknown. A host `make` build stamps the
same `git describe`, or dev. bsdaily logs the version on the first
line of every run and prints it with --version; a build that stamps
nothing, or an empty value, reports dev.

Judgement call: the build line also takes the canonical -trimpath and
-s -w.
One //nolint (gochecknoglobals): -X can only set a package-level
variable.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

Makefile

@@ -1,7 +1,9 @@
 .PHONY: all bootstrap setup check test lint fmt fmt-check build clean deps test-coverage test-integration install release release-snapshot docker hooks
 
-# Version number
-VERSION := 0.1.0-dev
+# Stamped into the binary: the same `git describe` a plain `docker build .`
+# runs, or dev when it prints nothing (outside a git checkout, or where git is
+# missing). ?= so that a VERSION already in the environment takes precedence.
+VERSION ?= $(or $(shell git describe --tags --always 2>/dev/null),dev)
 
 # Default target
 all: bsdaily
@@ -36,7 +38,7 @@ lint:
 
 # Build binary (pure Go; no CGO required since we use modernc.org/sqlite).
 bsdaily: internal/*/*.go cmd/bsdaily/*.go
-	CGO_ENABLED=0 go build -o $@ ./cmd/bsdaily
+	CGO_ENABLED=0 go build -ldflags "-X main.Version=$(VERSION)" -o $@ ./cmd/bsdaily
 
 # Clean build artifacts.
 clean: