Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` is now
the canonical one plus this repo's entries, sending `.git` without
`.git/config`. Given no build arguments, the builder stamps `git
describe --tags --always` and the commit and date from git, and fails
if `.git` is present but yields no version. The empty CHECK_EPOCH
refusal is gone so the plain build succeeds; the scripts still pass an
epoch. `script/version` now prints `git describe --tags --always
--dirty`, so make, the scripts and a plain build agree.

Model: opus-5-5

README.md

@@ -770,8 +770,9 @@ them. We provide:
 * `script/projectname` — print the project name (used for the Docker
   image tag)
 * `script/version` — print the version string to bake into the binary.
-  The `Makefile`'s `LDFLAGS` call this; it is the single source of truth
-  for the version. See [releasing](#releasing) for the rules.
+  The `Makefile`'s `LDFLAGS` call this, and `script/docker` and
+  `script/cibuild` pass its output to the image build. See
+  [releasing](#releasing) for the rules.
 * `script/install-goreleaser` — install the pinned `goreleaser` into
   `.tool/bin` from a sha256-verified release archive. Idempotent, and
   called by `script/bootstrap`; the release workflow calls it directly
@@ -863,16 +864,18 @@ them. We provide:
   module layers sit above the `ARG` and still cache, so a build is not
   cold.
 
-  A build that supplies no `CHECK_EPOCH` — a bare `docker build .` or
-  `docker build -f Dockerfile.lint .` — fails rather than lying. An
-  unset `ARG` is an empty string and an empty string is a stable cache
-  key, so without a guard such a build would serve every check layer
-  from cache, execute nothing, and still exit 0. Each file therefore
-  asserts the value is non-empty before running anything, and because
-  failed steps are never cached that assertion fires on every
-  invocation rather than once. Use `script/lint`, `script/docker` or
-  `script/cibuild`, which pass the arg; a bare `docker build` is a loud
-  error.
+  A `docker build -f Dockerfile.lint .` that supplies no `CHECK_EPOCH`
+  fails rather than lying. An unset `ARG` is an empty string and an
+  empty string is a stable cache key, so without a guard such a build
+  would serve the lint layer from cache, execute nothing, and still exit
+  0. `Dockerfile.lint` therefore asserts the value is non-empty before
+  running anything, and because failed steps are never cached that
+  assertion fires on every invocation rather than once. The product
+  `Dockerfile` has no such guard, because a plain `docker build .` must
+  succeed: without `CHECK_EPOCH`, rebuilding an unchanged checkout
+  replays its check layers from cache. Use `script/lint`,
+  `script/docker` or `script/cibuild`, which pass the arg, when the
+  checks must run.
 * `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
   not change files), then `script/check`
 * `script/install-precommit` — install the git pre-commit hook that
@@ -883,24 +886,31 @@ them. We provide:
 ### version numbers
 
 The version a binary reports comes from git, not from a constant in a
-file. `script/version` decides it, and everything that stamps a binary
-agrees with it:
+file. It is `git describe --tags --always --dirty`, which
+`script/version` runs for the `Makefile`, `script/docker` and
+`script/cibuild`:
 
-* `HEAD` is exactly on a tag → that tag with a leading `v` stripped, so
-  the tag `v1.0.0` produces `vaultik 1.0.0`, matching the archive name
-  `vaultik_1.0.0_linux_amd64.tar.gz`. `goreleaser` strips the prefix the
-  same way.
-* anything else → `dev-<12 chars of the commit sha>`.
-* either, with uncommitted changes to tracked files → a `-dirty`
+* `HEAD` is exactly on a tag → that tag, such as `v1.0.0`.
+* a commit after a tag → `<tag>-<N>-g<short sha>`.
+* no tag reachable → the short commit sha.
+* any of these, with uncommitted changes to tracked files → a `-dirty`
   suffix, because a modified checkout of a tag is not that tag.
 
-A build that is not a release never names itself like one. `vaultik
-version` says so in as many words on a development build, and
-`goreleaser --snapshot` stamps the same `dev-<sha>` string rather than
-inventing the next patch number. If `script/version` cannot be run at
-all, `make` stops with an error instead of building an unversioned
-binary, and a binary that somehow carries an empty version string still
-reports itself as a development build.
+A `docker build .` of a clone, with no build arguments, runs the same
+`git describe` (without `--dirty`) on the `.git` in its build context,
+so it stamps the same value for a clean commit; the build fails if the
+context carries `.git` and no version comes out. A binary built without
+git metadata reports `dev`.
+
+`goreleaser` stamps a release binary with the tag minus its leading
+`v`, so the tag `v1.0.0` produces `vaultik 1.0.0`, matching the archive
+name `vaultik_1.0.0_linux_amd64.tar.gz`. `goreleaser --snapshot` stamps
+`dev-<12 chars of the commit sha>` rather than inventing the next patch
+number. `vaultik version` calls `dev` and `dev-<sha>` development
+builds. If `script/version` cannot be run at all, `make` stops with an
+error instead of building an unversioned binary, and a binary that
+somehow carries an empty version string still reports itself as a
+development build.
 
 ### cutting a release