Stamp the tag or short commit in a plain docker build (closes #112)

.dockerignore now sends .git but not .git/config, which can hold a
credential and which git describe does not need. The build stage stamps
main.Gitrev from the VERSION build argument when one is given, otherwise
from git describe --tags --always, and fails if .git is present and no
version comes out. git there trusts /src whoever owns it, since a
context sent as a tar archive keeps its files' owners. script/docker is
replaced by the canonical copy, which passes VERSION; bin/gitrev.sh uses
--tags too, so every entrypoint stamps the same value for a clean
commit.

Model: opus-5-5

bin/gitrev.sh

@@ -3,5 +3,5 @@
 if [[ ! -z "$GITREV" ]]; then
     echo $GITREV
 else
-    git describe --always --dirty=-dirty
+    git describe --tags --always --dirty=-dirty
 fi