Build with the local docker daemon; add script/build (closes #44)

The Makefile exported DOCKER_HOST pointing at one private machine, so
every docker call made through make, `make lint` and `make check`
included, failed everywhere else. The line is gone: docker uses the
local daemon, or a DOCKER_HOST set in the environment.

`make build` now calls the new `script/build`, which stamps the version
and commit as the Makefile did. A VERSION set in the environment now
wins over `git describe`, not only one given as `make build VERSION=x`.
build, clean, install and docker-run are phony; install depends on
build. The vet target is removed: `script/test` runs `go vet` first.

Model: opus-5-5

TODO.md

@@ -25,6 +25,13 @@ Bring the repo into policy compliance in one commit:
 
 # Completed Steps
 
+- 2026-10-04: The `Makefile` no longer sets `DOCKER_HOST`, so its docker
+  targets use the local docker daemon, or whatever `DOCKER_HOST` the
+  environment sets. `make build` calls the new `script/build`, which
+  stamps the version (`VERSION` from the environment, else
+  `git describe`) and the git commit as before. `build`, `clean`,
+  `install` and `docker-run` are in `.PHONY`; `make install` depends on
+  `build`. The `vet` target is gone: `script/test` runs `go vet` first.
 - 2026-10-04: `secret init` refuses when the default vault exists, and
   `secret vault create NAME` when `NAME` does, with "vault NAME already
   exists", before writing anything. The check is in `vault.CreateVault`,