Stamp the git tag or short commit in a plain docker build (closes #46)

A plain `docker build .` stamped `unknown` into the page footer:
.dockerignore left out .git, and the Dockerfile built without the -X
flags. The context now carries .git without .git/config, which can hold
a credential. The build stage takes the VERSION build argument when one
is given, otherwise `git describe --tags --always`, fails the build if
.git is present and no version comes out, and stamps it together with
the full commit the footer links to. `make build` now uses
`git describe` as well, and script/docker is the current shared copy.

Model: opus-5-5

.dockerignore

@@ -1,7 +1,11 @@
 # Docker does not read .gitignore, and a pattern here matches from the root of
 # the build context only: a pattern meant for every directory needs `**/`.
 
-.git
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+.git/config
 
 # Local build and debug output: `make build`, `make run`, `make asupdate`, test
 # binaries, coverage profiles and source archives.