Build with the local docker daemon; add script/build (closes #44)

The Makefile exported DOCKER_HOST pointing at one private machine, so
every docker call made through make, `make lint` and `make check`
included, failed everywhere else. The line is gone: docker uses the
local daemon, or a DOCKER_HOST set in the environment.

`make build` now calls the new `script/build`, which stamps the version
and commit as the Makefile did. A VERSION set in the environment now
wins over `git describe`, not only one given as `make build VERSION=x`.
build, clean, install and docker-run are phony; install depends on
build. The vet target is removed: `script/test` runs `go vet` first.

Model: opus-5-5

README.md

@@ -506,6 +506,9 @@ them. We provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`secret`); used by
   other scripts such as `script/docker`
+- `script/build` — build the `secret` binary into the repo root, stamping
+  the version (`VERSION` from the environment, else `git describe`) and
+  the git commit
 - `script/test` — run `go vet` and the test suite (verbose rerun on
   failure)
 - `script/lint` — run `golangci-lint` in docker only: builds