Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

script/version

@@ -1,24 +1,24 @@
 #!/bin/sh
 # script/version: output the version string the binary is stamped with.
 # Our own extension to scripts-to-rule-them-all. The Makefile's build
-# target and script/docker both take the value from here, so a `make
-# build` binary and a `make docker` image built from the same checkout
-# report the same thing.
+# and version targets take the value from here, and the Dockerfile's
+# build stage calls them. script/docker and script/cibuild run the same
+# `git describe` on the host and pass the result in as $VERSION, so a
+# `make build` binary and a `make docker` image built from the same
+# checkout report the same thing.
 #
 # Order of precedence:
 #
-#   1. $VERSION, if set and non-empty. This is how the value reaches a
-#      build that cannot derive it: .dockerignore excludes .git/, so the
-#      builder stage has no git metadata and the Dockerfile takes the
-#      value as a build arg instead.
+#   1. $VERSION, if set and non-empty: an explicit value, such as the
+#      Dockerfile's VERSION build arg.
 #   2. `git describe --tags --always --dirty` against this checkout. At
 #      a clean tagged commit that is exactly the tag; otherwise it
 #      carries the short SHA, the commit distance when a tag is
 #      reachable, and a -dirty suffix for uncommitted changes.
 #   3. "unknown", for a tree with no git metadata and no $VERSION -- a
-#      source tarball, or `docker build .` with no --build-arg. That
-#      case must not fail the build and must not name a tag the tree may
-#      not be at, so it names nothing.
+#      source tarball, or a `docker build` with no .git in its context
+#      and no VERSION build arg. That case must not fail the build and
+#      must not name a tag the tree may not be at, so it names nothing.
 #
 # The git step insists the enclosing repository is this checkout, not
 # merely some repository above it: an unpacked tarball sitting inside an