Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` now
sends `.git` without `.git/config`. Given no build arguments, the
builder stamps `git describe --tags --always` and the commit and date
from git, and fails if `.git` is present but yields no version. The
empty CHECK_EPOCH refusal is gone so the plain build succeeds.
`script/version` now prints `git describe --tags --always --dirty`, so
make, the scripts and a plain build agree. `vaultik version` treats
the short commit, tag-N-gHASH forms and any version ending in `-dirty`
as development builds, so they keep the development-build notice.

Model: opus-5-5

script/cibuild

@@ -24,9 +24,11 @@ main() {
     # value is what forces those layers to re-run: without it an
     # unchanged tree replays them from cache, the checks never execute,
     # and the build still exits 0. Each ARG sits immediately above the
-    # check RUNs, so dependency and module layers still cache. Both
-    # Dockerfiles also refuse to build at all when CHECK_EPOCH is empty,
-    # so a missing value fails loudly here rather than passing quietly.
+    # check RUNs, so dependency and module layers still cache.
+    # Dockerfile.lint also refuses to build at all when CHECK_EPOCH is
+    # empty, so a missing value fails its build loudly rather than passing
+    # quietly; the product Dockerfile does not, because a plain `docker
+    # build .` must succeed.
     #
     # The value must be unique per invocation, not per second. `date +%s`
     # is second-granular, so two concurrent invocations in the same
@@ -57,12 +59,10 @@ main() {
         --build-arg CHECK_EPOCH="$epoch" -f Dockerfile.lint .
 
     # Version, commit and build date are computed here on the host, the
-    # same way script/docker does, and passed into the product build so
-    # the CI-built image reports its real source. The build context
-    # excludes .git (see .dockerignore), so the build cannot derive them
-    # itself; without these it would stamp the Dockerfile's dev/unknown
-    # fallbacks. VERSION comes from script/version, the source of truth
-    # shared with the Makefile.
+    # same way script/docker does, and passed into the product build,
+    # where they take precedence over what the build would derive from
+    # the .git in its context. VERSION comes from script/version, as in
+    # the Makefile.
     version="$("$ROOT/script/version")"
     commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
     commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"