Stamp the tag or short commit in a plain docker build (closes #21)

A plain `docker build .` of a clone stamped `dev`: `.dockerignore` left
out `.git` and the build stage declared `ARG VERSION=dev`. `.git` now
reaches the build context without `.git/config`, which can hold a
credential, and the build stage takes the VERSION build argument when
given, otherwise `git describe --tags --always`. A context that carries
`.git` but yields no version fails the build.

`script/docker` is replaced with the current canonical copy, which
passes the version it derives on the host.

Model: opus-5-5

Dockerfile

@@ -72,10 +72,22 @@ RUN go test -count=1 -timeout 90s -race -cover ./... || \
       go test -count=1 -timeout 90s -race -v ./...; exit 1; }
 
 # Static build, so the binary runs on any runtime base.
-ARG VERSION=dev
-RUN CGO_ENABLED=0 go build -trimpath \
-    -ldflags "-s -w -X main.version=${VERSION}" \
-    -o bin/simplexcalc ./cmd/simplexcalc
+#
+# The VERSION build arg when one is given, otherwise
+# `git describe --tags --always` on the .git in the build context. With
+# .git present, a version that is still empty, dev or unknown fails the
+# build: git is missing or could not read the checkout.
+ARG VERSION
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ]; then \
+        case "$VERSION" in ""|dev|unknown) \
+            echo "version is '$VERSION' although .git is present" >&2; \
+            exit 1 ;; \
+        esac; \
+    fi; \
+    CGO_ENABLED=0 go build -trimpath \
+        -ldflags "-s -w -X main.version=${VERSION}" \
+        -o bin/simplexcalc ./cmd/simplexcalc
 
 # Runtime stage, and the last one: script/cibuild passes no --target, so
 # BuildKit builds whichever stage is last and appending one drops lint,