Re-sync script/docker and script/cibuild with the model scripts (closes #265)

script/docker and script/cibuild are again byte-identical to the shared model
scripts. Both compute the version on the host with git describe, pass it as the
VERSION build arg and build with --no-cache; script/cibuild runs
script/bootstrap and script/check first. The CI build now stamps a real version
instead of unknown.

make build compiles with -trimpath and -s -w, as the model Dockerfile does.
script/version stays: the Makefile and the Dockerfile still use it.

The README describes both scripts as they now are.

Model: opus-5-5

script/docker

@@ -1,10 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# The tag comes from script/projectname.
-#
-# The version script/version resolves here goes in as the VERSION build
-# arg, which takes precedence over what the build would derive from the
-# .git in its context.
+# Identical in all repos; the tag comes from script/projectname.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -12,8 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build \
-        --build-arg VERSION="$("$SCRIPT_DIR/version")" \
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. VERSION is computed here because .dockerignore
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }