Stamp Docker image version from the host; flush profiles on error exit (closes #75)

script/docker and script/cibuild compute the version (via script/version),
commit and build date on the host and pass them as build args; the
Dockerfile no longer runs git, which always returned "unknown" because
the build context excludes .git. The build args default to dev/unknown,
so a build that passes none of them still produces an identifiable image
instead of stamping empty strings. A dirty tree is reflected through
script/version's -dirty suffix.

main now exits via os.Exit(run()), so its deferred CPU/heap profile
writers flush before the process ends, and Entry returns a status code
instead of calling os.Exit. Each command ran its operation in an fx
goroutine that called os.Exit(1) on failure, discarding those profiles
and the PID-lock release; they now route the error to the return path
through one RunOperation helper. errReported keeps Entry from printing an
already-reported failure twice.

model: claude-opus-4-8

internal/cli/app.go

@@ -11,6 +11,7 @@ import (
 	"os/signal"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -196,13 +197,90 @@ func RunApp(ctx context.Context, app *fx.App) error {
 	}
 }
 
+// errReported marks a failure the operation has already shown the user
+// (and deliberately withheld under --json). Entry turns it into a
+// non-zero exit status without printing anything further, so the error
+// line is not doubled. It flows up from RunOperation through cobra to
+// Entry.
+var errReported = errors.New("operation failed")
+
+// RunOperation runs op against the Vaultik instance inside the fx app
+// and turns a failure into a returned error rather than an os.Exit from
+// within the goroutine. An os.Exit there skipped main's deferred
+// profile writers -- so profiling a failing command yielded a truncated
+// profile (issue #75) -- and RunWithApp's PID-lock release, and denied
+// the app any graceful shutdown; returning the error to the top runs
+// all three.
+//
+// op runs in a goroutine so OnStart returns promptly and an interrupt
+// can still cancel through OnStop; when it finishes, success or failure,
+// it triggers shutdown, which is what lets RunWithApp return. report is
+// called with a non-canceled failure so the caller can log it (and
+// suppress it under --json) before it becomes errReported. A context
+// cancellation is the interrupt path, not a failure: it is neither
+// reported nor counted as one.
+func RunOperation(
+	ctx context.Context, opts AppOptions,
+	op func(v *vaultik.Vaultik) error, report func(err error),
+) error {
+	var (
+		mu     sync.Mutex
+		failed bool
+	)
+
+	opts.Invokes = append(opts.Invokes,
+		fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
+			lc.Append(fx.Hook{
+				OnStart: func(_ context.Context) error {
+					go func() {
+						err := op(v)
+						if err != nil && !errors.Is(err, context.Canceled) {
+							report(err)
+
+							mu.Lock()
+							failed = true
+							mu.Unlock()
+						}
+
+						stopErr := v.Shutdowner.Shutdown()
+						if stopErr != nil {
+							log.Error("Failed to shutdown", "error", stopErr)
+						}
+					}()
+
+					return nil
+				},
+				OnStop: func(_ context.Context) error {
+					v.Cancel()
+
+					return nil
+				},
+			})
+		}))
+
+	err := RunWithApp(ctx, opts)
+	if err != nil {
+		return err
+	}
+
+	// The goroutine sets failed before triggering the shutdown that lets
+	// RunWithApp return, so the write is in place by the time we read it.
+	mu.Lock()
+	defer mu.Unlock()
+
+	if failed {
+		return errReported
+	}
+
+	return nil
+}
+
 // runVaultikApp runs the standard single-operation command lifecycle
 // shared by the list/purge/verify/remove/remote-info subcommands:
-// resolve the config, start the fx app, run op against the Vaultik
-// instance in a goroutine, report a failure prefixed with failMsg
-// (suppressed while suppressErrors is true, e.g. under --json), then
-// trigger shutdown. The operation is cancelled when the app stops.
-// extraQuiet is OR-ed into LogOptions.Quiet (e.g. --json output modes).
+// resolve the config, then run op against the Vaultik instance through
+// RunOperation, reporting a failure prefixed with failMsg (suppressed
+// while suppressErrors is true, e.g. under --json). extraQuiet is OR-ed
+// into LogOptions.Quiet (e.g. --json output modes).
 func runVaultikApp(
 	cmd *cobra.Command, extraQuiet, suppressErrors bool,
 	failMsg string, op func(v *vaultik.Vaultik) error,
@@ -214,47 +292,20 @@ func runVaultikApp(
 
 	rootFlags := GetRootFlags()
 
-	return RunWithApp(cmd.Context(), AppOptions{
+	return RunOperation(cmd.Context(), AppOptions{
 		ConfigPath: configPath,
 		LogOptions: log.Options{
 			Verbose: rootFlags.Verbose,
 			Debug:   rootFlags.Debug,
 			Quiet:   rootFlags.Quiet || extraQuiet,
 		},
-		Modules: []fx.Option{},
-		Invokes: []fx.Option{
-			fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-				lc.Append(fx.Hook{
-					OnStart: func(_ context.Context) error {
-						go func() {
-							err := op(v)
-							if err != nil {
-								if !errors.Is(err, context.Canceled) {
-									if !suppressErrors {
-										log.Error(failMsg, "error", err)
-										ReportErrorf("%s: %v", failMsg, err)
-									}
+	}, op, func(err error) {
+		if suppressErrors {
+			return
+		}
 
-									os.Exit(1)
-								}
-							}
-
-							err = v.Shutdowner.Shutdown()
-							if err != nil {
-								log.Error("Failed to shutdown", "error", err)
-							}
-						}()
-
-						return nil
-					},
-					OnStop: func(_ context.Context) error {
-						v.Cancel()
-
-						return nil
-					},
-				})
-			}),
-		},
+		log.Error(failMsg, "error", err)
+		ReportErrorf("%s: %v", failMsg, err)
 	})
 }