Stamp the git tag or short commit into the binary (closes #4)

A plain `docker build .` now stamps bsdaily's version: the VERSION
build argument when one is given, otherwise `git describe --tags
--always` on the .git in the build context, as the canonical
Dockerfile does. The build fails if .git is there and the version
still comes out empty, dev or unknown. A host `make` build stamps the
same `git describe`, or dev. bsdaily logs the version on the first
line of every run and prints it with --version; a build that stamps
nothing, or an empty value, reports dev.

Judgement call: the build line also takes the canonical -trimpath and
-s -w.
One //nolint (gochecknoglobals): -X can only set a package-level
variable.

Model: opus-5-5

Makefile

@@ -1,9 +1,8 @@
 .PHONY: all bootstrap setup check test lint fmt fmt-check build clean deps test-coverage test-integration install release release-snapshot docker hooks
 
-# Stamped into the binary: the same `git describe` the Dockerfile runs, so a
-# host build reports the same version as the image, or dev when it prints
-# nothing (outside a git checkout, or where git is missing). ?= so that a
-# VERSION already in the environment takes precedence.
+# Stamped into the binary: the same `git describe` a plain `docker build .`
+# runs, or dev when it prints nothing (outside a git checkout, or where git is
+# missing). ?= so that a VERSION already in the environment takes precedence.
 VERSION ?= $(or $(shell git describe --tags --always 2>/dev/null),dev)
 
 # Default target

README.md

@@ -204,14 +204,18 @@ With no flags, the tool extracts the day before the latest snapshot. All
 progress is logged as structured `slog` text to stderr; the first line of every
 run carries the version.
 
-The version is the git tag or short commit the binary was built from, set at
-link time. `docker build .` takes it from the `VERSION` build argument when one
-is given, otherwise from `git describe --tags --always` on the `.git` in the
-build context, and fails if `.git` is there and the version still comes out
-empty, `dev` or `unknown`. `script/docker` and `script/cibuild` pass
-`git describe --tags --always --dirty` from the host as that argument. `make`
-runs the same `git describe` on the host. A build with no version to go on
-reports `dev`.
+The version is set at link time and depends on how the binary was built:
+
+- `docker build .` takes it from the `VERSION` build argument when one is given,
+  otherwise from `git describe --tags --always` on the `.git` in the build
+  context. The build fails if `.git` is there and the version still comes out
+  empty, `dev` or `unknown`. With neither `.git` nor `VERSION`, the binary
+  reports `dev`.
+- `script/docker`, `script/cibuild` and `make docker` pass the host's
+  `git describe --tags --always --dirty` as `VERSION`, so on a modified tree the
+  version ends in `-dirty`. When that prints nothing, they pass `unknown`.
+- `make` stamps the host's `git describe --tags --always`, without `-dirty`, or
+  `dev` when that prints nothing.
 
 ## Merging dumps back into a database