Build the binary without cgo (closes #545)

make build now builds with CGO_ENABLED=0, and the image builds through
it. The binary's only cgo code was mattn/go-sqlite3, which
gorm.io/driver/sqlite imports and webhooker never opens: every SQLite
file is opened with modernc.org/sqlite and the connection handed to
gorm. Without cgo, mattn's package compiles to a stub nothing calls.

The Dockerfile builds the binary once. The static relink and its
netgo, osusergo and sqlite_omit_load_extension tags are gone, and with
them the Makefile's GO_LDFLAGS and GO_TAGS, which only the relink used.
The test phase keeps cgo for -race. No README or Dockerfile sentence
says the binary needs cgo any more.

Model: opus-5-5

internal/versionscript/version_script_test.go

@@ -153,19 +153,15 @@ func TestVersion_IsStableAcrossInvocations(t *testing.T) {
 	require.Equal(t, first, second)
 }
 
-// The build target is the only place composing linker flags. If a
-// future edit drops either half, the binary silently reports "dev"
-// again (the defect this package exists for) or fails to link on
-// Alpine. If it stops passing GO_TAGS, the image's static binary links
-// glibc's getaddrinfo and dlopen again.
-func TestMakefile_BuildComposesVersionAndExtraFlags(t *testing.T) {
+// The build target is the only place that stamps the version. If a
+// future edit drops the -X flag, the binary silently reports "dev"
+// again, the defect this package exists for.
+func TestMakefile_BuildStampsTheVersion(t *testing.T) {
 	t.Parallel()
 
 	makefile := read(t, makefilePath)
 
 	require.Contains(t, makefile, "-X main.version=$(VERSION)")
-	require.Contains(t, makefile, "$(GO_LDFLAGS)")
-	require.Contains(t, makefile, "-tags '$(GO_TAGS)'")
 	require.Contains(t, makefile, "VERSION ?= $(shell script/version)")
 }
 
@@ -224,8 +220,8 @@ func requireMake(t *testing.T) {
 	}
 }
 
-// Every compile in the image goes through the build target, so the
-// static relink cannot replace the flags that carry the stamp.
+// The image compiles through the build target, so it carries the
+// target's version stamp.
 func TestDockerfile_BuildsThroughTheMakeTarget(t *testing.T) {
 	t.Parallel()
 
@@ -234,10 +230,7 @@ func TestDockerfile_BuildsThroughTheMakeTarget(t *testing.T) {
 	require.NotContains(t, dockerfile, "go build",
 		"a raw go build bypasses the Makefile's -X flag")
 	require.Contains(t, dockerfile, "ARG VERSION")
-	require.Contains(t, dockerfile,
-		`make build VERSION="$VERSION"`+
-			` GO_TAGS=netgo,osusergo,sqlite_omit_load_extension`+
-			` GO_LDFLAGS='-extldflags "-static"'`)
+	require.Contains(t, dockerfile, `RUN make build VERSION="$VERSION"`)
 }
 
 func read(t *testing.T, path string) string {