docker: report the real version in the image (closes #109)

The Dockerfile builder stage takes ARG VERSION (default `dev`) and passes
it to `make build` on the command line, which overrides the Makefile's
`git describe` default. script/docker computes the version from
`git describe` on the host and passes it as --build-arg VERSION, because
.dockerignore leaves .git out of the build context and `git describe`
inside the build only ever produced `dev`. A build that passes no
argument, such as script/cibuild, still reports `dev`.

`logger.Identify`, which logs `starting` with the version, was never
called; `main` now calls it first, so the version is in the startup log.

Model: opus-5-5

TODO.md

@@ -22,10 +22,6 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
 
 - 2026-10-01: the image built by `make docker` reports the `git describe`
   version, not `dev`, and the startup log now shows it (closes #109).
-- 2026-10-01: two notify shutdown tests always release the delivery they hold,
-  so a drain that returns early fails them instead of hanging (closes #176).
-- 2026-10-01: `script/install-precommit` asks git for the repository's git
-  directory, so `make hooks` also works where `.git` is a file (closes #129).
 - 2026-10-01: `TODO.md` brought up to date: open issues listed by URL, every
   Completed Steps entry cut to at most two lines (closes #146).
 - 2026-10-01: wildcard CORS now applies only to the public routes, not to
@@ -106,8 +102,12 @@ https://git.eeqj.de/sneak/dnswatcher/issues/104
 - `goimports` in `make fmt-check`, Markdown formatting:
   https://git.eeqj.de/sneak/dnswatcher/issues/119
 - final state save at shutdown: https://git.eeqj.de/sneak/dnswatcher/issues/114
+- `internal/notify` shutdown tests hang when a drain returns early:
+  https://git.eeqj.de/sneak/dnswatcher/issues/176
 - README accuracy sweep: https://git.eeqj.de/sneak/dnswatcher/issues/108
 - README sections required by policy:
   https://git.eeqj.de/sneak/dnswatcher/issues/173
+- `script/install-precommit` in a linked worktree:
+  https://git.eeqj.de/sneak/dnswatcher/issues/129
 - fixed root server order: https://git.eeqj.de/sneak/dnswatcher/issues/138
 - review toward 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/144

internal/notify/shutdown_test.go

@@ -143,12 +143,6 @@ func TestDrainWaitsForInFlightDelivery(t *testing.T) {
 	srv := blockingNtfyServer(entered, release, &served)
 	defer srv.Close()
 
-	// srv.Close waits for the handler, so release it however the
-	// test ends; otherwise a drain that returns early hangs the
-	// package instead of failing this test.
-	releaseHandler := sync.OnceFunc(func() { close(release) })
-	defer releaseHandler()
-
 	topicURL, _ := url.Parse(srv.URL)
 
 	svc := notify.NewTestService(http.DefaultTransport)
@@ -173,7 +167,9 @@ func TestDrainWaitsForInFlightDelivery(t *testing.T) {
 	// delay alone.
 	start := time.Now()
 
-	timer := time.AfterFunc(inFlightHold, releaseHandler)
+	timer := time.AfterFunc(inFlightHold, func() {
+		close(release)
+	})
 	defer timer.Stop()
 
 	ctx, cancel := context.WithTimeout(
@@ -272,7 +268,7 @@ func TestDrainBoundedByContextDeadline(t *testing.T) {
 	// all never returns here (the delivery is parked in a backoff
 	// that never fires), so an unbounded drain must fail this
 	// test promptly instead of hanging the package until the test
-	// binary's -timeout.
+	// binary's 30s timeout.
 	returned := make(chan struct{})
 
 	go func() {
@@ -451,11 +447,6 @@ func TestNewRegistersDrainingStopHook(t *testing.T) {
 	srv := blockingNtfyServer(entered, release, &served)
 	defer srv.Close()
 
-	// As in TestDrainWaitsForInFlightDelivery: release the handler
-	// however the test ends, before srv.Close waits for it.
-	releaseHandler := sync.OnceFunc(func() { close(release) })
-	defer releaseHandler()
-
 	lifecycle := &recordingLifecycle{}
 	svc := newNotifyService(t, lifecycle, srv.URL)
 
@@ -481,7 +472,9 @@ func TestNewRegistersDrainingStopHook(t *testing.T) {
 		t.Fatal("delivery never reached the endpoint")
 	}
 
-	timer := time.AfterFunc(inFlightHold, releaseHandler)
+	timer := time.AfterFunc(inFlightHold, func() {
+		close(release)
+	})
 	defer timer.Stop()
 
 	ctx, cancel := context.WithTimeout(

script/install-precommit

@@ -7,20 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Stop if this directory is not the top of its own git checkout, for
-    # example a copy inside another repository, whose hook must not be
-    # replaced.
-    if [ "$(git rev-parse --show-toplevel)" != "$ROOT" ]; then
-        echo "install-precommit: $ROOT is not the top of a git checkout" >&2
-        exit 1
-    fi
-    # Ask git for the repository's own git directory: .git is a file, not
-    # a directory, in some checkouts (for example a clone made with
-    # --separate-git-dir). core.hooksPath is deliberately not followed, so
-    # the hook is never written outside this repository.
-    hooks="$(git rev-parse --git-common-dir)/hooks"
-    mkdir -p "$hooks"
-    hook="$hooks/pre-commit"
+    hook=".git/hooks/pre-commit"
     printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
     chmod +x "$hook"
     echo "pre-commit hook installed: runs script/precommit"