Fetch the tags in the CI checkout (closes #208)

The standard checkout action clones shallow and fetches no tags, so the
version the build takes from `git describe --tags --always` would be a
bare commit even on a tagged commit. The checkout step now sets
`fetch-depth: 0`, as REPO_POLICIES.md asks of a repo that takes its
version from the tags.

Model: opus-5-5

TODO.md

@@ -31,6 +31,10 @@ P2: security: per-IP rate limiting on the image routes
 
 # Completed Steps
 
+- 2026-10-04 the CI checkout fetches the tags (closes #208): the checkout step
+  in `.gitea/workflows/check.yml` sets `fetch-depth: 0`, as `REPO_POLICIES.md`
+  asks of a repo that takes its version from the tags, so a CI build of a tagged
+  commit stamps the tag from `git describe` instead of a bare commit.
 - 2026-10-04 `config.yml` stays out of git and the Docker build context (closes
   #212): `.gitignore` now ignores `config.yml`, the config file Getting Started
   creates with the signing key, and `.dockerignore` leaves it out in every