Stamp the tag or short commit in a plain docker build (closes #112)

.dockerignore now sends .git but not .git/config, which can hold a
credential and which git describe does not need. The build stage stamps
main.Gitrev from the VERSION build argument when one is given, otherwise
from git describe --tags --always, and fails if .git is present and no
version comes out. script/docker is replaced by the canonical copy,
which passes VERSION; bin/gitrev.sh uses --tags too, so every entrypoint
stamps the same value for a clean commit.

Model: opus-5-5

bin/gitrev.sh

@@ -3,5 +3,5 @@
 if [[ ! -z "$GITREV" ]]; then
     echo $GITREV
 else
-    git describe --always --dirty=-dirty
+    git describe --tags --always --dirty=-dirty
 fi