docker: a plain docker build . stamps the git version (closes #210)

A plain `docker build .`, which is how upaas builds, stamped `dev`:
`.dockerignore` left out `.git` and the builder declared
`ARG VERSION=dev`. `.dockerignore` now sends `.git` and lists no tracked
file, which git in the build would count as deleted and mark `-dirty`.
`ARG VERSION` has no default. The Makefile takes `VERSION` from the
environment with `?=`, so a build arg still wins (`script/docker` keeps
passing one); otherwise `git describe` runs in the builder. A new
`make version` prints the version, and the builder fails when the
context carries `.git` and it comes out empty, `dev` or `unknown`.

Model: opus-5-5

.dockerignore

@@ -1,9 +1,6 @@
-.git/
+# .git is sent: the builder stage derives the version it stamps into the
+# binary from it. No tracked file may be listed here: git in the build
+# would see it as deleted and mark the version -dirty, and an excluded .md
+# would silently drop out of the prettier check in Dockerfile.fmt.
 bin/
 node_modules/
-# No .md may be excluded: Dockerfile.fmt checks every document with
-# prettier, and an exclusion here would drop a file from that check while
-# prettier still reports every file it was handed clean.
-LICENSE
-.editorconfig
-.gitignore