Stamp the tag or short commit in a plain docker build (closes #21)

A plain `docker build .` of a clone stamped `dev`: `.dockerignore` left
out `.git` and the build stage declared `ARG VERSION=dev`. `.git` now
reaches the build context without `.git/config`, which can hold a
credential, and the build stage takes the VERSION build argument when
given, otherwise `git describe --tags --always`. A context that carries
`.git` but yields no version fails the build.

`script/docker` is replaced with the current canonical copy, which
passes the version it derives on the host.

Model: opus-5-5

docs/TODO.md

@@ -27,6 +27,10 @@ with no deprecation warning.
 
 # Completed Steps
 
+- 2026-10-02 A plain `docker build .` of a clone stamps the commit's tag
+  or short commit instead of `dev`: `.dockerignore` sends `.git` without
+  `.git/config`, and the build stage takes the `VERSION` build argument
+  when given, otherwise `git describe --tags --always`
 - 2026-09-29 Exact results past the range of a double, such as `2^1200`,
   are written to 17 significant digits instead of being refused, and a
   fractional power of such a number, such as `(2^1200)^0.5`, is answered