Re-sync script/docker and script/cibuild with the model scripts (closes #265)

script/docker and script/cibuild are again byte-identical to the shared model
scripts. Both compute the version on the host with git describe, pass it as the
VERSION build arg and build with --no-cache; script/cibuild runs
script/bootstrap and script/check first. The CI build now stamps a real version
instead of unknown.

make build compiles with -trimpath and -s -w, as the model Dockerfile does.
script/version stays: the Makefile and the Dockerfile still use it.

The README describes both scripts as they now are.

Model: opus-5-5

Makefile

@@ -48,8 +48,11 @@ fmt-check:
 check:
 	@script/check
 
+# -trimpath keeps the build directory out of the binary, so two builds of one
+# commit match wherever they ran; -s -w drop the symbol table and debug info,
+# which panics and stack traces do not use.
 build: assets
-	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
+	go build -trimpath -ldflags '$(strip -s -w -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker