Assign the image tag on its own line in script/ (closes #101)

script/cibuild, script/docker, script/lint and script/test passed the
tag from script/projectname inline to docker build, where a failing
command substitution does not trip set -e. Each now assigns it to `tag`
on its own line first, so the script stops where script/projectname
fails. The comment above it says why; the REPO_POLICIES.md snippets show
the same form.

Model: opus-5-5

script/docker

@@ -10,15 +10,17 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Own line: a failing command substitution inside an argument does
-    # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
-    # the version a build stage derives from the .git in the context.
+    # The version and the tag each get their own line: a failing
+    # command substitution inside an argument does not trip `set -e`,
+    # so the inline form degrades silently to an empty constant. The
+    # VERSION build argument takes precedence over the version a build
+    # stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
+    tag="$("$SCRIPT_DIR/projectname")"
     docker build --no-cache \
         --build-arg VERSION="$version" \
-        -t "$("$SCRIPT_DIR/projectname")" .
+        -t "$tag" .
 }
 
 main "$@"