Stamp the build version into the binary (closes #253)

Dockerfile

@@ -61,14 +61,28 @@ RUN script/fetch-assets
 
 # Run tests and build
 RUN make test
-RUN make build
+
+# Version stamped into the binary. .dockerignore excludes .git/, so
+# nothing in this stage can derive it: script/docker resolves it on the
+# host and passes it in. The default is what a bare `docker build .`
+# with no --build-arg gets, and it names no tag the tree may not be at.
+#
+# Declared here, below the test and asset steps, so a changed version
+# does not invalidate their cached layers.
+ARG VERSION=unknown
+
+RUN make build VERSION="$VERSION"
 
 # Rebuild with static linking for Alpine runtime.
 # make build already verified compilation.
 # The CGO binary from `make build` is dynamically linked against glibc,
 # which doesn't exist on Alpine (musl). Rebuild with static linking so
 # the binary runs on Alpine without glibc.
-RUN CGO_ENABLED=1 go build -ldflags '-extldflags "-static"' -o bin/webhooker ./cmd/webhooker
+#
+# The static flags go in through GO_LDFLAGS rather than a -ldflags of
+# their own: the build target composes them with the -X that stamps the
+# version, so this relink cannot silently drop the stamp.
+RUN CGO_ENABLED=1 make build VERSION="$VERSION" GO_LDFLAGS='-extldflags "-static"'
 
 # Runtime stage
 # alpine:3.21, 2026-03-17