Derive the image's version from the .git in the build context (closes #366)

A plain docker build, as upaas runs it, passed no VERSION build arg and
had no .git, so every such image stamped "unknown". .dockerignore now
sends .git without its config, which can carry a credential, and every
tracked file (an excluded one would read as deleted and mark the version
-dirty). The VERSION build arg loses its "unknown" default, so
script/version derives the version inside the build; a given VERSION
still takes precedence.

The builder stage installs git, trusts the copied checkout whoever owns
its files, and fails when its context carries .git and the version still
comes out "unknown". The CI fingerprint is now the commit being checked.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -12,9 +12,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 2024-10-23
         with:
-          # The fingerprint step below needs history to find the last commit
-          # that touched the Docker build context, and the superseded-status
-          # step needs it to walk ancestors (it aborts on a shallow clone).
+          # The superseded-status step needs history to walk ancestors (it
+          # aborts on a shallow clone).
           fetch-depth: 0
 
       - name: Mark superseded run statuses
@@ -28,16 +27,11 @@ jobs:
         run: script/ci-mark-superseded
 
       - name: Fingerprint the build context
-        # `.dockerignore` keeps docs out of the build context, so a docs-only
-        # commit legitimately replays the whole image from cache and stays
-        # cheap. Every other commit writes a new fingerprint into the context,
-        # which invalidates the `COPY . .` layer of both check stages: a
-        # commit that was never linted, formatted-checked, tested and built
-        # cannot report success from cache.
-        run: |
-          set -eu
-          fp="$(git log -1 --format=%H -- . ':!*.md' ':!LICENSE' ':!.editorconfig')"
-          printf '%s\n' "${fp:-$GITHUB_SHA}" > .ci-fingerprint
+        # Writes the hash of the commit being checked into the context, which
+        # invalidates the `COPY . .` layer of both check stages: a commit
+        # that was never linted, format-checked, tested and built cannot
+        # report success from cache.
+        run: git rev-parse HEAD > .ci-fingerprint
 
       - name: Build Docker image (runs make check)
         run: script/cibuild