Report the Go build info version when linker flags set none (closes #422)

A binary from go install, the README's first command, reported itself as version dev, a development build, although Go had recorded the tag it was built from. When the linker flags leave the version, commit or commit date unset, they are now filled in from the Go build info, so such a binary reports its tag and counts as a release. Builds through make, script/docker and goreleaser are unchanged.

Model: opus-5-5

README.md

@@ -1039,20 +1039,37 @@ is `git describe --tags --always --dirty`, which `script/version` runs for the
 A `docker build .` of a clone, with no build arguments, runs the same
 `git describe` (without `--dirty`) on the `.git` in its build context, so it
 stamps the same value for a clean commit; the build fails if the context carries
-`.git` and no version, commit or commit date comes out. A binary built without
-git metadata reports `dev`, or `unknown` when `script/docker` or
-`script/cibuild` built it outside a git checkout.
+`.git` and no version, commit or commit date comes out. `make` outside a git
+checkout and `docker build .` without `.git` both stamp `dev`. `script/docker`
+and `script/cibuild` stamp `unknown` when they run outside a git checkout.
+
+A binary built by plain `go install` or `go build` carries no stamped version.
+It reports the version Go recorded in it instead:
+
+- a `go install` of the tag `v1.0.0` → `v1.0.0`.
+- a `go build` of an untagged commit → a Go pseudo-version, such as
+  `v1.0.1-0.20261110231226-0123456789ab`.
+- a build where Go recorded no version → `dev`.
 
 `goreleaser` stamps a release binary with the tag minus its leading `v`, so the
 tag `v1.0.0` produces `vaultik 1.0.0`, matching the archive name
 `vaultik_1.0.0_linux_amd64.tar.gz`. `goreleaser --snapshot` stamps
 `dev-<12 chars of the commit sha>` rather than inventing the next patch number.
-`vaultik version` calls a build a development build when its version is `dev`,
-`unknown`, `dev-<sha>`, the short commit sha or `<tag>-<N>-g<short sha>`, with
-or without `-dirty`; only a plain tag, such as `v1.0.0` or `1.0.0`, is a
-release. If `script/version` cannot be run at all, `make` stops with an error
-instead of building an unversioned binary, and a binary that somehow carries an
-empty version string still reports itself as a development build.
+
+`vaultik version` calls a build a development build when its version is one of
+these:
+
+- `dev` or `unknown`.
+- `dev-<sha>`.
+- the short commit sha.
+- `<tag>-<N>-g<short sha>`.
+- a Go pseudo-version.
+- any version with a `-dirty` or `+dirty` suffix.
+
+Only a plain tag, such as `v1.0.0` or `1.0.0`, is a release. If `script/version`
+cannot be run at all, `make` stops with an error instead of building an
+unversioned binary. A binary stamped with an empty version reports the version
+Go recorded in it; if Go recorded none, it is a development build.
 
 ### cutting a release