Stamp the git tag or short commit in a plain docker build (closes #67)

.dockerignore now sends .git, without .git/config, which can hold a
credential. The build stage takes the VERSION build argument when one
is given, otherwise git describe --tags --always of that .git, and
fails if the context carries .git and still yields no version. A plain
docker build . used to stamp dev.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -6,6 +6,4 @@ jobs:
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              with:
-                  fetch-depth: 0
             - run: script/cibuild

TODO.md

@@ -36,9 +36,7 @@
   stage takes the `VERSION` build argument when one is given,
   otherwise `git describe --tags --always` of that `.git`. The build
   fails if the context carries `.git` and the version still comes out
-  empty, `dev` or `unknown`. The CI checkout step fetches the full
-  history (`fetch-depth: 0`) so CI sees the tag and stamps the same
-  value as `make build`.
+  empty, `dev` or `unknown`.
 
 - replace the 1 KiB end-window sampling with the head/tail plus
   content-hash ladder (2026-09-22, branch `next`, closes