Stamp the git tag or short commit in a plain docker build (closes #46)

A plain `docker build .` stamped `unknown` into the page footer:
.dockerignore left out .git, and the Dockerfile built without the -X
flags. The context now carries .git without .git/config, which can hold
a credential. The build stage takes the VERSION build argument when one
is given, otherwise `git describe --tags --always`, fails the build if
.git is present and no version comes out, and stamps it together with
the full commit the footer links to. `make build` now uses
`git describe` as well, and script/docker is the current shared copy.

Model: opus-5-5

internal/version/version.go

@@ -7,7 +7,8 @@ package version
 var (
 	// GitRevision is the git commit hash
 	GitRevision = "unknown"
-	// GitRevisionShort is the short git commit hash (7 chars)
+	// GitRevisionShort is the version the page footer shows: the tag or
+	// short commit hash from `git describe --tags --always`
 	GitRevisionShort = "unknown"
 )