docker build . stamps the git tag or short commit, not dev (closes #154)

A plain `docker build .` now stamps the version from git rather than `dev`/`0.0.0`. After `tsc`, `script/build` writes into `dist/package.json` the version `script/version` decides: `VERSION` when given, otherwise `git describe --tags --always` (the tag; or tag, commits since and short commit; or the short commit), otherwise `package.json`'s. A checkout with `.git` that yields an empty, `dev` or `unknown` version fails the build. `.dockerignore` sends `.git` but not `.git/config`, so no remote URL or credential reaches the image. `ARG VERSION` has no default, and the host scripts' version still wins.

Not changed: `REPO_POLICIES.md` still says `ARG VERSION=dev` until the shared policy changes.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

src/index.ts

@@ -1,5 +1,7 @@
-// package.json is the one place the version is written. tsc copies it to
-// dist/package.json, so this path resolves from source and from dist/src/.
+// A build reports the version script/build stamps into dist/package.json;
+// package.json's own version is reported only when running from source. tsc
+// copies package.json to dist/package.json, so this path resolves from source
+// and from dist/src/.
 import pkg from "../package.json" with { type: "json" };
 
 export const VERSION: string = pkg.version;