Stamp the build version into the binary (closes #253)

The binary reported "dev" in every deployment: main.version carried a
placeholder and nothing ever set it. Neither `make build` nor the
Dockerfile passed -X, so a tagged release produced an artifact that
could not say which commit it was, and the upgrade procedure's "confirm
the new build is live" step had nothing to confirm against.

script/version is now the single source of the value: $VERSION when
set, else `git describe --tags --always --dirty`, else "unknown". A
clean checkout at a tag reports exactly that tag; a tree with no git
metadata reports "unknown" rather than failing or naming a tag it may
not be at. Nothing time- or host-dependent is stamped, so two builds of
one commit stay byte-identical.

The Makefile's build target composes the flags -- `-X main.version` plus
whatever GO_LDFLAGS adds -- and every compile goes through it, including
the Dockerfile's static relink, which now contributes its -extldflags
through GO_LDFLAGS instead of replacing -ldflags wholesale. Since
.dockerignore excludes .git/, the image cannot derive the version: it
takes a VERSION build arg, defaulted to "unknown", that script/docker
fills in from the host checkout.

The UI footer needed the other half of the fix. It renders .Version,
which nothing ever put in the template data, so it printed its literal
"dev" fallback no matter what the binary was built as; renderTemplate
now supplies the value on both the map and the wrapper path.

internal/versionscript/doc.go

@@ -0,0 +1,12 @@
+// Package versionscript holds the tests for script/version and for the
+// build files that consume it. It carries no runtime code: the version
+// string is produced by a shell script at build time and reaches the
+// binary through a linker flag, so nothing in the Go build graph can
+// assert it, but the behaviour still has to be verified by the test
+// suite.
+//
+// The files under test are outside the Go build graph, so `go test`'s
+// result cache serves a stale PASS when only script/version, the
+// Makefile or the Dockerfile changed: run the container build, or
+// GOFLAGS=-count=1, to trust a result here after editing them.
+package versionscript