Stamp Docker image version from the host; flush profiles on error exit (closes #75)

Docker images reported commit unknown because the build ran git inside the container while .dockerignore excludes .git, and VERSION was never overridden. script/docker and script/cibuild now compute version, commit and date on the host and pass them as build args; the Dockerfile runs no git and falls back to dev and unknown, never empty, on a bare docker build.

Profiling a failing command gave a truncated or missing profile: Entry and each command goroutine called os.Exit(1), skipping the deferred profile writers in main. Entry now returns a status that main exits with after its defers run, and command goroutines report failure through one RunOperation helper, which also restores PID-lock release and graceful shutdown on failure.

model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)

Co-authored-by: clawbot <clawbot@noreply.example.org>

Dockerfile

@@ -20,8 +20,6 @@
 # golang:1.26.1-alpine, 2026-03-17
 FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
 
-ARG VERSION=dev
-
 # Build tooling: make, plus a C toolchain because `go test -race` needs cgo.
 # The sqlite driver is pure Go (modernc.org/sqlite), so no sqlite library or
 # CLI is required.
@@ -66,8 +64,31 @@ RUN [ -n "$CHECK_EPOCH" ] || exit 1
 RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
 RUN echo "check epoch: ${CHECK_EPOCH}" && make test
 
+# Version, commit and build date are computed on the host by
+# script/docker and script/cibuild (where .git exists) and passed in as
+# build args. The build context excludes .git (see .dockerignore), so
+# the build cannot derive them itself: it used to try, with `git
+# rev-parse` inside this stage, and always got "unknown". VERSION comes
+# from script/version, the source of truth shared with the Makefile, so
+# it carries the same tag / dev-<sha> / -dirty rules and a Docker image
+# reports the same string a local build of the same tree would.
+#
+# The defaults are the fallback for a bare `docker build .` that passes
+# none of them: an unset arg would otherwise stamp an empty string and
+# produce an image that cannot report its own version, commit or date.
+# They match what an out-of-git build reports elsewhere.
+#
+# These ARGs sit here, after the checks, rather than at the top of the
+# stage: every commit changes their values, and a value change
+# invalidates all layers below the ARG. Declared up top they would bust
+# `go mod download`; here they only rekey this build layer, which the
+# COPY of the sources above already rebuilds on any change anyway.
+ARG VERSION=dev
+ARG COMMIT=unknown
+ARG COMMIT_DATE=unknown
+
 # Build (pure Go, no CGO required since we use modernc.org/sqlite)
-RUN CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${VERSION}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=$(git rev-parse HEAD 2>/dev/null || echo unknown)' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)'" -o /vaultik ./cmd/vaultik
+RUN CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${VERSION}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=${COMMIT}' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=${COMMIT_DATE}'" -o /vaultik ./cmd/vaultik
 
 # Runtime stage
 # alpine:3.21, 2026-02-25