Tag the image build in the checklist's script/cibuild item (closes #125)

The new-repository checklist gave script/cibuild's image build without
a tag, so a repository written from it left a dangling image behind on
every run. The item now gives the build as the canonical script/cibuild
runs it, with -t "$tag" and the tag assigned from script/projectname on
its own line. The other docker build commands the checklists and
REPO_POLICIES.md give for script/ already matched their scripts.

Model: opus-5-5

TODO.md

@@ -21,15 +21,13 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now matches
-  the canonical `script/cibuild` (issue 125). Its image build carries the tag,
-  `-t "$tag"`, and the item says that `$version` comes from
-  `git describe --tags --always --dirty` (`unknown` if empty) and `$tag` from
-  `script/projectname`, each assigned on its own line before the build. A
+- 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now gives the
+  image build with its tag, `-t "$tag"`, assigned from `script/projectname` on
+  its own line, as the canonical `script/cibuild` runs it (issue 125). A
   repository written from the checklist got an untagged build, which leaves a
-  dangling image behind on every run, and was never told where `$version` comes
-  from. The other `docker build` commands the checklists and `REPO_POLICIES.md`
-  give for `script/` already matched their scripts.
+  dangling image behind on every run. The other `docker build` commands the
+  checklists and `REPO_POLICIES.md` give for `script/` already matched their
+  scripts.
 - 2026-10-07: `script/lint` and `script/test` now build with
   `--output type=cacheonly` in place of a tag (issue 123), so they still run
   their phase uncached and fail on a failing step but write no image. Nothing

prompts/NEW_REPO_CHECKLIST.md

@@ -165,11 +165,9 @@ are thin shims calling them. Model scripts:
 - [ ] `script/cibuild` — cd to repo root, run `script/bootstrap`, run
       `script/check`, then
       `docker build --no-cache --build-arg VERSION="$version" -t "$tag" .` (what
-      CI runs), with `$version` from `git describe --tags --always --dirty`
-      (`unknown` if empty) and `$tag` from `script/projectname`, each assigned
-      on its own line before the build. The bootstrap is required: CI checks out
-      and runs this alone, and `script/fmt-check` runs the formatter on the
-      host.
+      CI runs), with `$tag` assigned from `script/projectname` on its own line
+      before the build. The bootstrap is required: CI checks out and runs this
+      alone, and `script/fmt-check` runs the formatter on the host.
 - [ ] `script/fmt` and `script/fmt-check` source nvm for the pinned node version
       before invoking `yarn`, as `script/bootstrap`'s own install step does.
       `script/bootstrap` leaves the node and yarn it installs off the `PATH` of