docker build . stamps the git tag or short commit, not dev (closes #154)

script/build writes the version script/version prints into
dist/package.json, which quak --version reports: the VERSION environment
variable or build arg when one is given, otherwise git describe --tags
--always, otherwise package.json's version. A checkout with .git whose
version comes out empty, dev or unknown fails the build.

.dockerignore no longer leaves out .git, and ARG VERSION has no default,
so a plain docker build . of a clone stamps its commit. script/docker and
script/cibuild still pass the host's version. make build-bin bundles the
built dist/, so the single binary reports the same version.

Model: opus-5-5

.dockerignore

@@ -1,9 +1,9 @@
 # Mirrors .gitignore, with one deliberate exception: .gitignore itself stays
 # in the build context, because prettier 3 reads it as a default ignore file
 # and dropping it would change what the lint phase's prettier check sees.
-
-# VCS
-.git
+#
+# .git is deliberately NOT excluded: the build derives the version it stamps
+# from it (script/version).
 
 # OS
 .DS_Store