Keep in-repo agent scratch out of the build context and out of git (closes #27)

The canonical .dockerignore and .gitignore both omitted the in-repo agent
scratch directory, which holds one worktree per in-flight agent, so under
`COPY . .` an entire extra checkout of the repo reached the image. The
two entries are deliberately different shapes: anchored in .dockerignore,
where the `**/` form would also delete a legitimately named nested
directory, and unanchored in .gitignore, where a pattern already matches
at every depth. Anchoring leaves a gap where agents run in
subdirectories, stated in the vendored file itself. The second half is
the consequence of excluding .git: `git describe` in a build stage yields
an empty version without erroring, so the version is now computed on the
host and passed in.

Model: opus-5

TODO.md

@@ -21,6 +21,12 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-09-08: Kept in-repo agent scratch out of the Docker build context and out
+  of version control: `.claude/` is one full checkout of the repo per in-flight
+  agent, and under `COPY . .` all of it was reaching the image. Also closed the
+  consequence of excluding `.git` — `git describe` yields an empty version
+  inside a build stage without failing, so `script/docker` and `script/cibuild`
+  now compute the version on the host and pass `--build-arg VERSION`.
 - 2026-09-08: Closed the secret exposure in the canonical `.dockerignore`: a
   local `.env`, `*.pem` or `*.key` was reaching the build context under
   `COPY . .`, invisible to every git-based check. The patterns are now written