docker: a plain docker build . stamps the git version (closes #210)

A plain `docker build .`, which is how upaas builds, stamped `dev`:
`.dockerignore` left out `.git` and the builder declared
`ARG VERSION=dev`. `.dockerignore` now sends `.git` and lists no tracked
file, which git in the build would count as deleted and mark `-dirty`.
`ARG VERSION` has no default. The Makefile takes `VERSION` from the
environment with `?=`, so a build arg still wins (`script/docker` keeps
passing one); otherwise `git describe` runs in the builder. A new
`make version` prints the version, and the builder fails when the
context carries `.git` and it comes out empty, `dev` or `unknown`.

Model: opus-5-5

Dockerfile.fmt

@@ -30,9 +30,8 @@ COPY . .
 # --config, not discovery: a .prettierrc that failed to arrive would
 # otherwise leave prettier on its defaults, where proseWrap is "preserve"
 # and every wrap this check exists to enforce passes. Missing the file is
-# a hard error instead. --no-editorconfig for the same reason in reverse:
-# .editorconfig is not in the build context, so honouring it here and on
-# a developer's machine would be two different answers.
+# a hard error instead. --no-editorconfig so that .prettierrc alone sets
+# the style.
 RUN prettier --config .prettierrc --no-editorconfig --check "**/*.md"
 
 # Write path. Not a check: script/fmt builds this and takes the files.