Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` now
sends `.git` without `.git/config`. Given no build arguments, the
builder stamps `git describe --tags --always` and the commit and date
from git, and fails if `.git` is present but yields no version. The
empty CHECK_EPOCH refusal is gone so the plain build succeeds.
`script/version` now prints `git describe --tags --always --dirty`, so
make, the scripts and a plain build agree. `vaultik version` treats
the short commit, tag-N-gHASH forms and any version ending in `-dirty`
as development builds, so they keep the development-build notice.

Model: opus-5-5

script/docker

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
+# The tag comes from script/projectname. Unlike the canonical copy in
+# sneak/prompts, it passes a fresh CHECK_EPOCH instead of --no-cache, and
+# COMMIT and COMMIT_DATE as well as VERSION.
 #
 # This builds the PRODUCT image only, and the product Dockerfile has no
 # lint stage: linting lives in Dockerfile.lint and is run by
@@ -21,19 +22,15 @@ main() {
     # comments there. This script is not the CI gate, but a local build
     # is almost always warm, so without this it would report a green the
     # tree had not earned and the two entrypoints would disagree about
-    # whether the tree is clean. The Dockerfile now refuses to build
-    # without a non-empty value, so this is required, not optional.
+    # whether the tree is clean.
     epoch="$(date +%s%N)$$"
 
-    # Version, commit and build date are computed here on the host,
-    # where .git exists, and passed into the build. The build context
-    # excludes .git (see .dockerignore), so the container cannot derive
-    # them itself -- it used to try and always got "unknown", giving
-    # every image a "commit: unknown" it could not be traced from.
-    # VERSION comes from script/version, the source of truth shared with
-    # the Makefile, so a Docker build reports the same string (tag,
-    # dev-<sha>, or a -dirty variant) that a local build of the same
-    # tree would.
+    # Version, commit and build date are computed here on the host and
+    # passed into the build, where they take precedence over what the
+    # build would derive from the .git in its context. VERSION comes
+    # from script/version, as in the Makefile, so the image reports the
+    # same string, -dirty included, that a local build of the same tree
+    # would.
     version="$("$SCRIPT_DIR/version")"
     commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
     commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"