Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps bsdaily's version: the VERSION
build argument when one is given, otherwise `git describe --tags
--always` on the .git in the build context, as the canonical
Dockerfile does. The build fails if .git is there and the version
still comes out empty, dev or unknown. A host `make` build stamps the
same `git describe`, or dev. bsdaily logs the version on the first
line of every run and prints it with --version; a build that stamps
nothing, or an empty value, reports dev.

Judgement call: the build line also takes the canonical -trimpath and
-s -w.
One //nolint (gochecknoglobals): -X can only set a package-level
variable.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

README.md

@@ -189,6 +189,7 @@ A single run proceeds as follows:
 bsdaily                          # extract the snapshot date minus one day
 bsdaily --date 2026-06-27        # extract a single specific day
 bsdaily --from 2026-06-01 --to 2026-06-27   # extract an inclusive range
+bsdaily --version                # print the version and exit
 ```
 
 Flags:
@@ -197,9 +198,24 @@ Flags:
   `--from`/`--to`.
 - `--from YYYY-MM-DD` — start of an inclusive range (requires `--to`).
 - `--to YYYY-MM-DD` — end of an inclusive range (requires `--from`).
+- `-v`, `--version` — print the version and exit.
 
 With no flags, the tool extracts the day before the latest snapshot. All
-progress is logged as structured `slog` text to stderr.
+progress is logged as structured `slog` text to stderr; the first line of every
+run carries the version.
+
+The version is set at link time and depends on how the binary was built:
+
+- `docker build .` takes it from the `VERSION` build argument when one is given,
+  otherwise from `git describe --tags --always` on the `.git` in the build
+  context. The build fails if `.git` is there and the version still comes out
+  empty, `dev` or `unknown`. With neither `.git` nor `VERSION`, the binary
+  reports `dev`.
+- `script/docker`, `script/cibuild` and `make docker` pass the host's
+  `git describe --tags --always --dirty` as `VERSION`, so on a modified tree the
+  version ends in `-dirty`. When that prints nothing, they pass `unknown`.
+- `make` stamps the host's `git describe --tags --always`, without `-dirty`, or
+  `dev` when that prints nothing.
 
 ## Merging dumps back into a database