Let a plain docker build pass and stamp the git version (closes #57)

The size tests skip a case whose secret needs more locked memory than
RLIMIT_MEMLOCK allows: memguard panics otherwise, and a plain
`docker build .` runs under an 8 MiB limit. script/cibuild still runs
every case.

The build stage stamps the VERSION build argument, else
`git describe --tags --always`, and fails when .git is present but
yields no version. `make build` stamps `git describe` too instead of
the fixed 0.1.0. .dockerignore keeps .git/config out; script/docker is
now the canonical copy.

Model: opus-5-5

TODO.md

@@ -26,8 +26,8 @@ Bring the repo into policy compliance in one commit:
 # Completed Steps
 
 - 2026-10-02: A plain `docker build .` builds again: the size tests
-  skip a case that needs more locked memory than the process can
-  lock, and run every case under `script/cibuild`. The image stamps the
+  skip a case that needs more locked memory than the limit allows,
+  and run every case under `script/cibuild`. The image stamps the
   `VERSION` build argument, else `git describe --tags --always`, into
   `Version`, and fails if `.git` is present but yields no version;
   `make build` stamps `git describe` too, not a fixed `0.1.0`.

internal/cli/secrets_size_test.go

@@ -28,37 +28,24 @@ const testVaultName = "test-vault"
 // size, and they are then copied into one more buffer of its size.
 const lockedBytesPerSecretByte = 3
 
-// skipIfLockedMemoryTooLow skips the test when this process cannot lock
-// the memory a secret of size bytes needs, found by locking a buffer of
-// that size and releasing it. memguard panics, ending the whole test run,
-// when it cannot lock a buffer, and a plain `docker build .` runs the
-// tests under an 8 MiB locked-memory limit (RLIMIT_MEMLOCK). A process
-// allowed to lock past that limit runs every case.
+// skipIfLockedMemoryTooLow skips the test when the locked-memory limit
+// (RLIMIT_MEMLOCK) cannot hold a secret of size bytes. memguard panics,
+// ending the whole test run, when it cannot lock a buffer, and a plain
+// `docker build .` runs the tests under an 8 MiB limit.
 func skipIfLockedMemoryTooLow(t *testing.T, size int) {
 	t.Helper()
 
-	need := lockedBytesPerSecretByte * size
+	var limit unix.Rlimit
 
-	buf, err := unix.Mmap(-1, 0, need,
-		unix.PROT_READ|unix.PROT_WRITE, unix.MAP_PRIVATE|unix.MAP_ANON)
+	err := unix.Getrlimit(unix.RLIMIT_MEMLOCK, &limit)
 	require.NoError(t, err)
 
-	lockErr := unix.Mlock(buf)
-
-	// Unmapping the buffer also unlocks it.
-	err = unix.Munmap(buf)
-	require.NoError(t, err)
-
-	if lockErr != nil {
-		var limit unix.Rlimit
-
-		err = unix.Getrlimit(unix.RLIMIT_MEMLOCK, &limit)
-		require.NoError(t, err)
-
+	//nolint:gosec // test sizes are never negative
+	need := lockedBytesPerSecretByte * uint64(size)
+	if limit.Cur < need {
 		t.Skipf("a %d-byte secret needs up to %d bytes of locked memory, "+
-			"which could not be locked under the locked-memory limit "+
-			"(RLIMIT_MEMLOCK) of %d bytes: %v",
-			size, need, limit.Cur, lockErr)
+			"more than the locked-memory limit (RLIMIT_MEMLOCK) of %d bytes",
+			size, need, limit.Cur)
 	}
 }