Stamp the git tag or short commit in a plain docker build (closes #35)

.dockerignore left out .git, so make build inside the image fell back to
"dev". The build context now carries .git, without its config, which can
hold a credential in the remote URL. The build stage takes the VERSION
build argument when one is given, otherwise git describe --tags --always,
and fails if the context carries .git and no version comes out.

Model: opus-5-5

.dockerignore

@@ -1,3 +1,4 @@
-.git
+# .git is sent so the build can stamp the version, without its config.
+.git/config
 .gitea
 /keyfunc