script/build stamps lightweight tags too (closes #156)

When VERSION is unset or empty, script/build now takes the version from
`git describe --tags --always --dirty`, the form script/docker and
script/cibuild use. Without --tags it ignored lightweight tags, so a
binary from `make build` could report a commit where the image built
from the same tree reported the tag. README.md Entrypoints names the
same form.

Model: opus-5-5

.dockerignore

@@ -73,9 +73,12 @@
 
 # This repository's own entries, after the shared content above: the
 # frontend build, the viewport test's output, the binary `make build`
-# writes and the reports `make run` stores, and log files at the root.
+# writes and the reports `make run` stores, and Go test binaries,
+# coverage output and log files at the root.
 /dist
 /tmp
 /netwatch-server
 /data
+/*.test
+/*.out
 /*.log

TODO.md

@@ -28,6 +28,14 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
   skipped lightweight tags, so `make run` could report a commit where the image
   built from the same tree reported the tag. Checked once with a lightweight tag
   on a scratch clone: `make build` stamped it
+- 2026-10-19: `.dockerignore` keeps Go test binaries and coverage output at the
+  root out of the build context, with `/*.test` and `/*.out` in the repository's
+  own section ([#155](https://git.eeqj.de/sneak/netwatch/issues/155)). Such
+  files went into the build context of every `docker build` in `script/` and
+  were copied into the lint, test and build stages. Checked with a probe image
+  that copies the whole context: `x.test` and `x.out` planted at the root no
+  longer land in it, and nothing else changed. The entries match only at the
+  root, so the same files in a subdirectory still reach the image
 - 2026-10-19: `.gitea/workflows/check.yml` is the sneak/prompts copy at
   `0653579` ([#153](https://git.eeqj.de/sneak/netwatch/issues/153)). Its
   checkout step sets `fetch-depth: 0`, so CI clones all history and tags, and