docker build . stamps the git tag or short commit, not dev (closes #154)

script/build writes the version script/version prints into
dist/package.json, which quak --version reports: the VERSION environment
variable or build arg when one is given, otherwise git describe --tags
--always, otherwise package.json's version. A checkout with .git whose
version comes out empty, dev or unknown fails the build.

.dockerignore no longer leaves out .git, and ARG VERSION has no default,
so a plain docker build . of a clone stamps its commit. script/docker and
script/cibuild still pass the host's version. make build-bin bundles the
built dist/, so the single binary reports the same version.

Model: opus-5-5

script/build

@@ -1,7 +1,7 @@
 #!/bin/sh
-# script/build: compile the TypeScript sources into dist/, then verify that
-# the artifacts package.json advertises are among the files the compiler
-# actually wrote. tsc reports success by exit status alone and knows nothing
+# script/build: compile the TypeScript sources into dist/, stamp the version
+# script/version prints into it, then verify that the artifacts package.json
+# advertises are among the files the compiler actually wrote. tsc reports success by exit status alone and knows nothing
 # about the manifest, so without this step a green build can still ship a
 # package whose main, types or bin resolve to nothing. Our own extension to
 # scripts-to-rule-them-all.
@@ -46,13 +46,24 @@ for (const bin of bins) {
 }
 
 # src/index.ts imports ../package.json for the version, which tsc copies to
-# dist/package.json. Running the built CLI proves that import resolves from
-# dist/ and reports the version package.json declares.
+# dist/package.json. The version script/version prints is written into that
+# copy only; the repo's own package.json is left as it is.
+stamp_version() {
+    node -e '
+const { readFileSync, writeFileSync } = require("node:fs");
+
+const pkg = JSON.parse(readFileSync("dist/package.json", "utf-8"));
+pkg.version = process.argv[1];
+writeFileSync("dist/package.json", JSON.stringify(pkg, null, 4) + "\n");
+' "$1"
+}
+
+# Running the built CLI proves the import resolves from dist/ and reports
+# the stamped version.
 verify_version() {
     built="$(node dist/bin/quak.js --version)"
-    declared="$(node -p 'require("./package.json").version')"
-    if [ "$built" != "$declared" ]; then
-        echo "build: dist/bin/quak.js reports $built, package.json declares $declared" >&2
+    if [ "$built" != "$1" ]; then
+        echo "build: dist/bin/quak.js reports $built, the build stamped $1" >&2
         exit 1
     fi
     echo "build: dist/bin/quak.js reports version $built"
@@ -60,9 +71,12 @@ verify_version() {
 
 main() {
     cd "$ROOT"
+    # Own line, so that a failing script/version stops the build.
+    version="$("$ROOT/script/version")"
     yarn run tsc
+    stamp_version "$version"
     verify_entrypoints
-    verify_version
+    verify_version "$version"
 }
 
 main "$@"