script/build stamps lightweight tags too (closes #156)

When VERSION is unset or empty, script/build now takes the version from
`git describe --tags --always --dirty`, the form script/docker and
script/cibuild use. Without --tags it ignored lightweight tags, so a
binary from `make build` could report a commit where the image built
from the same tree reported the tag. README.md Entrypoints names the
same form.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -1,9 +1,20 @@
 name: check
 on: [push]
+# Free the shared runner: a new push cancels only the same branch's older run.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
+        # Free the shared runner from a hung build.
+        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+              # script/cibuild needs no token, so none is left in .git/config.
+              with:
+                  persist-credentials: false
+                  # All history and tags, so git describe finds the version tag.
+                  fetch-depth: 0
             - run: script/cibuild

TODO.md

@@ -12,7 +12,8 @@
 pre-1.0. No git tags. `main` is the stable branch and `next` the development
 branch, which every PR targets. The frontend and the Go backend ship as one
 Docker image, and the Gitea workflow `.gitea/workflows/check.yml` runs
-`script/cibuild` on every push. Working toward 1.0.0.
+`script/cibuild` on every push, and cancels the older run on the same branch.
+Working toward 1.0.0.
 
 # Next Step
 
@@ -27,6 +28,14 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
   skipped lightweight tags, so `make run` could report a commit where the image
   built from the same tree reported the tag. Checked once with a lightweight tag
   on a scratch clone: `make build` stamped it
+- 2026-10-19: `.gitea/workflows/check.yml` is the sneak/prompts copy at
+  `0653579` ([#153](https://git.eeqj.de/sneak/netwatch/issues/153)). Its
+  checkout step sets `fetch-depth: 0`, so CI clones all history and tags, and
+  `git describe` in `script/cibuild` gives the image built from a tagged commit
+  the tag as its version; it gave the short commit. The checkout step also sets
+  `persist-credentials: false`, so the job's token is not left in `.git/config`.
+  A new push cancels the older run on the same branch, and a run stops after 20
+  minutes
 - 2026-10-19: `script/bootstrap` keeps the `yarn` on `PATH` only when
   `yarn --version` is exactly `YARN_VERSION`, and otherwise installs that
   version as it did when no yarn was installed