check / check (push) Successful in 46s
The size tests skip a case whose secret needs more locked memory than RLIMIT_MEMLOCK allows: memguard panics otherwise, and a plain `docker build .` runs under an 8 MiB limit. script/cibuild still runs every case. The build stage stamps the VERSION build argument, else `git describe --tags --always`, and fails when .git is present but yields no version. `make build` stamps `git describe` too instead of the fixed 0.1.0. .dockerignore keeps .git/config out; script/docker is now the canonical copy. Model: opus-5-5