Derive the image version from git; send .git without its config (closes #69, closes #71)

The canonical documents told every repo to exclude .git from the build
context, default ARG VERSION to dev and never run git describe in a
build stage, so an image built from a clone with no build argument
reported dev. .dockerignore now sends .git but keeps out .git/config,
which can hold a credential. The Dockerfile example installs git, takes
the VERSION build argument when one is given and otherwise
git describe --tags --always, and fails when .git exists but the version
is empty, dev or unknown. The policy and both checklists state the rule
in the same words, including that a plain docker build . with no build
arguments must succeed.

Model: opus-5-5

TODO.md

@@ -21,6 +21,15 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-02: The image version now comes from git inside the build (issues 69
+  and 71), superseding the 2026-09-08 entry that excluded `.git`. The canonical
+  `.dockerignore` sends `.git` but keeps out `.git/config`, which can hold a
+  credential. The Dockerfile example in `REPO_POLICIES.md` installs `git`, takes
+  the `VERSION` build argument when one is given and otherwise
+  `git describe --tags --always`, and fails when `.git` exists but the version
+  is empty, `dev` or `unknown`; a plain `docker build .` with no build arguments
+  must succeed. This repo's `script/docker` and `script/cibuild` still pass
+  `--build-arg VERSION`, since its own `Dockerfile` compiles nothing.
 - 2026-09-08: Moved linting and testing into Docker as phases of the main
   `Dockerfile`, per the owner ruling on issue 40. `script/lint` and
   `script/test` build one phase each by name with `--no-cache` — the same answer