Stamp the git tag or short commit in a plain docker build (closes #46)

A plain `docker build .` stamped `unknown` into the page footer:
.dockerignore left out .git, and the Dockerfile built without the -X
flags. The context now carries .git without .git/config, which can hold
a credential. The build stage takes the VERSION build argument when one
is given, otherwise `git describe --tags --always`, fails the build if
.git is present and no version comes out, and stamps it together with
the full commit the footer links to. `make build` now uses
`git describe` as well, and script/docker is the current shared copy.

Model: opus-5-5

TODO.md

@@ -28,6 +28,11 @@ The other open issue is https://git.eeqj.de/sneak/routewatch/issues/30.
 
 # Completed Steps
 
+- 2026-10-02: a plain `docker build .` stamps the commit's tag or short
+  commit (`git describe --tags --always`) into the page footer instead of
+  `unknown`: `.dockerignore` sends `.git` without `.git/config`, a `VERSION`
+  build argument takes precedence, and `make build` stamps the same value
+  (closes #46)
 - 2026-09-29: the entrypoint creates the data directory if it is missing and
   stops the start if a step fails; README "Running under upaas" no longer
   asks for the host directory to be created first (closes #42)