Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` now
sends `.git` without `.git/config`. Given no build arguments, the
builder stamps `git describe --tags --always` and the commit and date
from git, and fails if `.git` is present but yields no version. The
empty CHECK_EPOCH refusal is gone so the plain build succeeds.
`script/version` now prints `git describe --tags --always --dirty`, so
make, the scripts and a plain build agree. `vaultik version` treats
the short commit, tag-N-gHASH forms and any version ending in `-dirty`
as development builds, so they keep the development-build notice.

Model: opus-5-5

Dockerfile

@@ -20,10 +20,10 @@
 # golang:1.26.1-alpine, 2026-03-17
 FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
 
-# Build tooling: make, plus a C toolchain because `go test -race` needs cgo.
-# The sqlite driver is pure Go (modernc.org/sqlite), so no sqlite library or
-# CLI is required.
-RUN apk add --no-cache make build-base
+# Build tooling: make, plus a C toolchain because `go test -race` needs cgo,
+# and git, which derives the version below. The sqlite driver is pure Go
+# (modernc.org/sqlite), so no sqlite library or CLI is required.
+RUN apk add --no-cache make build-base git
 
 WORKDIR /src
 
@@ -47,48 +47,44 @@ COPY . .
 # unreferenced-ARG handling staying as it is. It also puts the epoch in
 # the build log, where a reader can see the layer was keyed fresh.
 #
-# The guard is what makes a build that omits --build-arg fail instead of
-# lie. An unset ARG is an empty string, and an empty string is a
-# perfectly stable cache key: without the guard the first such build
-# runs the checks and every one after it on an unchanged tree replays
-# these layers from cache, executes nothing, and still exits 0. Failed
-# steps are never cached, so the guard fails on EVERY invocation rather
-# than once -- a bare `docker build .` is a loud error, not a quiet
-# green. Do not give CHECK_EPOCH a default value; a default would
-# satisfy the guard with a constant and restore the hole.
+# A build that passes no CHECK_EPOCH, such as a plain `docker build .`,
+# keys these layers on the empty string, so rebuilding an unchanged
+# checkout replays them from cache and runs nothing. Only the scripts'
+# builds mean the checks executed.
 #
 # Everything above this line (apk, go.mod, `go mod download`) is
 # deliberately outside the busted range and keeps caching.
 ARG CHECK_EPOCH
-RUN [ -n "$CHECK_EPOCH" ] || exit 1
 RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
 RUN echo "check epoch: ${CHECK_EPOCH}" && make test
 
-# Version, commit and build date are computed on the host by
-# script/docker and script/cibuild (where .git exists) and passed in as
-# build args. The build context excludes .git (see .dockerignore), so
-# the build cannot derive them itself: it used to try, with `git
-# rev-parse` inside this stage, and always got "unknown". VERSION comes
-# from script/version, the source of truth shared with the Makefile, so
-# it carries the same tag / dev-<sha> / -dirty rules and a Docker image
-# reports the same string a local build of the same tree would.
-#
-# The defaults are the fallback for a bare `docker build .` that passes
-# none of them: an unset arg would otherwise stamp an empty string and
-# produce an image that cannot report its own version, commit or date.
-# They match what an out-of-git build reports elsewhere.
+# Version, commit and build date: the build args when given (script/docker
+# and script/cibuild pass the ones they compute on the host), otherwise
+# derived from the .git in the build context. The version is then `git
+# describe --tags --always`: the tag on a tagged commit, tag-N-gHASH after
+# one, the short commit when no tag is reachable. A context that carries
+# .git and still yields no version fails the build; one without .git, as
+# from a source tarball, stamps "dev" and an "unknown" commit and date.
 #
 # These ARGs sit here, after the checks, rather than at the top of the
 # stage: every commit changes their values, and a value change
 # invalidates all layers below the ARG. Declared up top they would bust
 # `go mod download`; here they only rekey this build layer, which the
 # COPY of the sources above already rebuilds on any change anyway.
-ARG VERSION=dev
-ARG COMMIT=unknown
-ARG COMMIT_DATE=unknown
+ARG VERSION
+ARG COMMIT
+ARG COMMIT_DATE
 
 # Build (pure Go, no CGO required since we use modernc.org/sqlite)
-RUN CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${VERSION}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=${COMMIT}' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=${COMMIT_DATE}'" -o /vaultik ./cmd/vaultik
+RUN version="${VERSION:-$(git describe --tags --always || echo dev)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "the build context carries .git but yields no version" >&2; \
+        exit 1; \
+    fi; \
+    commit="${COMMIT:-$(git rev-parse HEAD || echo unknown)}"; \
+    commit_date="${COMMIT_DATE:-$(git show -s --format=%cs HEAD || echo unknown)}"; \
+    CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${version}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=${commit}' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=${commit_date}'" -o /vaultik ./cmd/vaultik
 
 # Runtime stage
 # alpine:3.21, 2026-02-25