Keep in-repo agent scratch out of the build context and out of git (closes #27)

The canonical .dockerignore and .gitignore both omitted the in-repo agent
scratch directory, which holds one worktree per in-flight agent, so under
`COPY . .` an entire extra checkout of the repo reached the image. The
two entries are deliberately different shapes: anchored in .dockerignore,
where the `**/` form would also delete a legitimately named nested
directory, and unanchored in .gitignore, where a pattern already matches
at every depth. Anchoring leaves a gap where agents run in
subdirectories, stated in the vendored file itself. The second half is
the consequence of excluding .git: `git describe` in a build stage yields
an empty version without erroring, so the version is now computed on the
host and passed in.

Model: opus-5

prompts/NEW_REPO_CHECKLIST.md

@@ -35,7 +35,11 @@ Template files can be fetched from:
 
 - [ ] `.gitignore` — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore`, extend for
-      language-specific artifacts
+      language-specific artifacts. Extensions are written to `.gitignore`'s own
+      semantics, where an unanchored pattern already matches at every depth:
+      never add a `**/` prefix here, which is a `.dockerignore` form. The
+      canonical file already carries `.claude/` so agent worktrees cannot be
+      committed by accident.
 - [ ] `.editorconfig` — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`
 - [ ] `Makefile` — fetch from
@@ -58,7 +62,16 @@ Template files can be fetched from:
       `cmd/myapp/` and delete the package directory. Do not transplant
       `.gitignore`'s patterns: `.dockerignore` anchors an unprefixed pattern at
       the context root, so the copied form leaves `config/.env` in the build
-      context while reading as solved.
+      context while reading as solved. The canonical file's `.claude` entry is
+      anchored for the same reason as a repo-root binary; leave it that way, but
+      note that it only covers agents running at the repo root — if this repo
+      will run them in subdirectories, `services/api/.claude/` needs its own
+      anchored entry.
+    - If the image embeds a version in a binary, the version is computed on the
+      host and passed with `--build-arg VERSION=...`, and `ARG VERSION=dev` is
+      declared in the stage that compiles. **No stage calls `git describe`** —
+      `.dockerignore` excludes `.git`, so it yields an empty version without
+      failing the build.
     - All Dockerfiles must run `make check` as a build step
     - Server: also builds and runs the application
     - Non-server: brings up dev environment and runs `make check`