Derive the image version from git; send .git without its config (closes #69, closes #71)

The canonical documents told every repo to exclude .git from the build
context, default ARG VERSION to dev and never run git describe in a
build stage, so an image built from a clone with no build argument
reported dev. .dockerignore now sends .git but keeps out .git/config,
which can hold a credential. The Dockerfile example installs git, takes
the VERSION build argument when one is given and otherwise
git describe --tags --always, and fails when .git exists but the version
is empty, dev or unknown. The policy and both checklists state the rule
in the same words, including that a plain docker build . with no build
arguments must succeed.

Model: opus-5-5

prompts/GO_HTTP_SERVER_CONVENTIONS.md

@@ -1,6 +1,6 @@
 ---
 title: Go HTTP Server Conventions
-last_modified: 2026-09-08
+last_modified: 2026-10-02
 ---
 
 This document defines the architectural patterns, design decisions, and
@@ -984,13 +984,10 @@ func main() {
 Use ldflags to inject version information at build time:
 
 ```makefile
-# ?= rather than := because this `$(shell git describe ...)` is only correct
-# on the host: `.dockerignore` excludes `.git`, so evaluated inside a build
-# stage it expands to the empty string without failing and the binary reports
-# no version. The version is computed on the host by `script/docker` /
-# `script/cibuild` and passed with `--build-arg VERSION=...`; where the build
-# stage invokes make, `ARG VERSION` puts it in the environment and `?=` defers
-# to it.
+# ?= rather than := so that a `VERSION` build argument takes precedence:
+# where a build stage invokes make, `ARG VERSION` puts it in the
+# environment and `?=` defers to it. Otherwise `git describe` runs, in a
+# build stage on the `.git` the build context carries.
 VERSION ?= $(shell git describe --tags --always)
 
 build: