docker build . stamps the git tag or short commit, not dev (closes #154)

A plain `docker build .` now stamps the version from git rather than `dev`/`0.0.0`. After `tsc`, `script/build` writes into `dist/package.json` the version `script/version` decides: `VERSION` when given, otherwise `git describe --tags --always` (the tag; or tag, commits since and short commit; or the short commit), otherwise `package.json`'s. A checkout with `.git` that yields an empty, `dev` or `unknown` version fails the build. `.dockerignore` sends `.git` but not `.git/config`, so no remote URL or credential reaches the image. `ARG VERSION` has no default, and the host scripts' version still wins.

Not changed: `REPO_POLICIES.md` still says `ARG VERSION=dev` until the shared policy changes.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

README.md

@@ -126,9 +126,12 @@ alpine. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (our own extension); used by
   `script/docker` for the image tag
-- `script/build` — compile the TypeScript sources into `dist/`, then verify that
-  the entrypoints `package.json` declares (`main`, `types`, `bin`) are among the
-  files the compiler wrote, and make the CLI executable (our own extension)
+- `script/build` — compile the TypeScript sources into `dist/`, stamp the
+  version into `dist/package.json`, then verify that the entrypoints
+  `package.json` declares (`main`, `types`, `bin`) are among the files the
+  compiler wrote, and make the CLI executable (our own extension)
+- `script/version` — print the version `script/build` stamps (our own
+  extension); see Version below
 - `script/test` — run the test suite, by building the `test` phase of the
   `Dockerfile` (vitest, 90s timeout, verbose rerun on failure); requires docker
 - `script/lint` — run eslint and a prettier check, by building the `lint` phase
@@ -176,6 +179,34 @@ an exact version, installed from `yarn.lock` under `--frozen-lockfile` in both
 places, and reads `.gitignore` as its default ignore file — which is why
 `.dockerignore` keeps `.gitignore` in the build context.
 
+### Version
+
+`quak --version` reports the `version` of `dist/package.json`, which
+`script/build` writes after compiling; the repo's own `package.json` keeps
+`0.0.0`, and that is what the tests, which run from source, report.
+`script/version` decides what is written:
+
+- the `VERSION` environment variable, or the `Dockerfile`'s `VERSION` build arg
+  (`--build-arg VERSION=...`), when one is given and not empty;
+- otherwise, in a checkout with `.git`, `git describe --tags --always`: the tag
+  on a tagged commit; the tag, the commits since it and the short commit on a
+  later commit (`v1.2.3-4-gabc1234`); the short commit when no tag is reachable;
+- otherwise, as in a source tarball, the version `package.json` declares.
+
+The build fails if the checkout has `.git` and the version still comes out
+empty, `dev` or `unknown`: such a build could not be traced back to its commit.
+
+`.dockerignore` therefore does not leave out `.git`, so any `docker build .` of
+a clone stamps the commit it was built from; a shallow clone stamps a tag only
+when the cloned commit itself carries one, and otherwise the short commit. It
+leaves out `.git/config`, which holds the clone's remote URL and any credential
+in it, so the image carries `.git` without its config; `git describe` does not
+need that file. `script/docker` (and so `make docker`) and `script/cibuild` pass
+the version they resolve on the host, with `--dirty`, as the build arg, which
+takes precedence. The image's `org.opencontainers.image.version` label carries
+that build arg only, so a build given none leaves it empty. `make build-bin`
+bundles the built `dist/`, so the single binary reports the stamped version too.
+
 ## Rationale
 
 Ente is one of very few photo services with a credible end-to-end encryption