Derive the image version from git; send .git without its config (closes #69, closes #71)

The canonical documents told every repo to exclude .git from the build
context, default ARG VERSION to dev and never run git describe in a
build stage, so an image built from a clone with no build argument
reported dev. .dockerignore now sends .git but keeps out .git/config,
which can hold a credential. The Dockerfile example installs git, takes
the VERSION build argument when one is given and otherwise
git describe --tags --always, and fails when .git exists but the version
is empty, dev or unknown. The policy and both checklists state the rule
in the same words, including that a plain docker build . with no build
arguments must succeed.

Model: opus-5-5

prompts/CODE_STYLEGUIDE_GO.md

@@ -1,6 +1,6 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-09-08
+last_modified: 2026-10-02
 ---
 
 1.  Try to hard wrap long lines at 77 characters or less.
@@ -48,14 +48,11 @@ last_modified: 2026-09-08
     ```
 
     ```make
-    # ?= rather than := because this `$(shell git describe ...)` is only
-    # correct on the host: `.dockerignore` excludes `.git`, so evaluated
-    # inside a build stage it expands to the empty string without failing
-    # and the binary reports no version. The version is computed on the
-    # host by `script/docker` / `script/cibuild` and passed with
-    # `--build-arg VERSION=...`; where a build stage invokes make,
-    # `ARG VERSION` puts it in the environment and `?=` defers to it.
-    VERSION ?= $(shell git describe --always --dirty)
+    # ?= rather than := so that a `VERSION` build argument takes precedence:
+    # where a build stage invokes make, `ARG VERSION` puts it in the
+    # environment and `?=` defers to it. Otherwise `git describe` runs, in a
+    # build stage on the `.git` the build context carries.
+    VERSION ?= $(shell git describe --tags --always)
 
     GOLDFLAGS += -X main.Version=$(VERSION)