build: stamp container builds with the real version instead of "-unk"

.dockerignore excludes .git, so util/genbuild.sh finds no repository inside
the container and emits "// No build information available", which
clientversion.cpp renders as the "-unk" suffix. Every binary produced by
./build.sh --linux-compat therefore self-reports "v1.2.0-unk" and cannot be
traced to a commit -- including release artifacts, since this build path is
part of the v1.2.0 tag.

Pre-generating src/obj/build.h does not survive (genbuild rewrites it when the
content differs), and simply un-ignoring .git does not help a linked worktree,
whose .git is a file pointing outside the build context.

So build.sh computes the version on the host, mirroring genbuild.sh rule for
rule -- the nearest tag only when HEAD is that tag and the tree is clean,
otherwise v<VERSION>-<short sha> with a -dirty suffix -- and passes it through
a BUILD_DESC build-arg that Dockerfile.compat exports as DRAGONX_BUILD_DESC.
genbuild.sh honours that variable when set and is otherwise untouched; with
git metadata present it emits a byte-identical build.h.

Every added git call is guarded with || true because build.sh runs under
set -eu -o pipefail: a source tarball, a host without git, or a branch whose
only reachable tags are lightweight (v1.0.1-v1.0.3 are lightweight; v1.1.0 is
the first annotated one) would otherwise abort the build with no diagnostic.
Those cases now degrade to the previous "-unk" behaviour with a warning.

A direct "docker build -f Dockerfile.compat" passes no BUILD_DESC and still
produces -unk; the Dockerfile now says so loudly rather than silently.

Dockerfile.compat

@@ -27,6 +27,17 @@ RUN rm -rf /build/depends/built /build/depends/work \
     && rm -rf /build/src/cc/*.o /build/src/cc/*.a \
     && rm -f /build/config.status /build/config.log
 
+# The build context excludes .git (see .dockerignore), so genbuild.sh cannot derive
+# a version and would stamp the binaries "-unk". build.sh computes the real one
+# on the host and passes it in here.
+ARG BUILD_DESC=
+ENV DRAGONX_BUILD_DESC=${BUILD_DESC}
+
+RUN if [ -z "$DRAGONX_BUILD_DESC" ]; then \
+      echo "WARNING: no BUILD_DESC build-arg -- binaries will be stamped -unk." >&2; \
+      echo "         Prefer ./build.sh --linux-compat, or pass --build-arg BUILD_DESC=..." >&2; \
+    fi
+
 RUN cd /build && ./util/build.sh --disable-tests -j$(nproc)
 
 # Strip binaries inside the container so extracted files are already small

build.sh

@@ -164,7 +164,34 @@ if [ $BUILD_LINUX_COMPAT -eq 1 ] || [ $BUILD_LINUX_RELEASE -eq 1 ] || [ $BUILD_W
         COMPAT_RELEASE_DIR="$RELEASE_DIR/dragonx-$VERSION-$COMPAT_PLATFORM"
 
         echo "Building Docker image (Ubuntu 20.04 base)..."
-        $DOCKER_CMD build -f Dockerfile.compat -t "$DOCKER_IMAGE" .
+        # .dockerignore excludes .git, so genbuild.sh inside the container cannot
+        # derive the version and would stamp the binaries "-unk". Compute it on the
+        # host, mirroring util/genbuild.sh exactly, and pass it in via --build-arg.
+        # NB: build.sh runs under `set -eu -o pipefail`, so every git call here must be
+        # non-fatal -- a source tarball, a machine without git, or a branch whose only
+        # reachable tags are lightweight (v1.0.1-v1.0.3) would otherwise abort the build.
+        git diff >/dev/null 2>&1 || true   # refresh index: touched-but-unmodified are not dirty
+        COMPAT_BUILD_DESC=""
+        COMPAT_RAWDESC=$(git describe --abbrev=0 2>/dev/null || true)
+        if [ -n "$COMPAT_RAWDESC" ] \
+           && [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-list -1 "$COMPAT_RAWDESC" 2>/dev/null)" ] \
+           && git diff-index --quiet HEAD -- 2>/dev/null; then
+            COMPAT_BUILD_DESC="$COMPAT_RAWDESC"
+        else
+            COMPAT_SUFFIX=$(git rev-parse --short HEAD 2>/dev/null || true)
+            if [ -n "$COMPAT_SUFFIX" ]; then
+                git diff-index --quiet HEAD -- 2>/dev/null || COMPAT_SUFFIX="$COMPAT_SUFFIX-dirty"
+                COMPAT_BUILD_DESC="v$VERSION-$COMPAT_SUFFIX"
+            fi
+        fi
+        if [ -n "$COMPAT_BUILD_DESC" ]; then
+            echo "Stamping container build as: $COMPAT_BUILD_DESC"
+        else
+            echo "Warning: no usable git metadata; container binaries will be stamped -unk"
+        fi
+        $DOCKER_CMD build -f Dockerfile.compat \
+            --build-arg BUILD_DESC="$COMPAT_BUILD_DESC" \
+            -t "$DOCKER_IMAGE" .
 
         echo "Extracting binaries from Docker image..."
         CONTAINER_ID=$($DOCKER_CMD create "$DOCKER_IMAGE")

util/genbuild.sh

@@ -18,7 +18,12 @@ fi
 
 DESC=""
 SUFFIX=""
-if [ -e "$(which git 2>/dev/null)" -a "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
+# Allow the build system to supply the version when git metadata is unavailable:
+# container builds exclude .git, and a linked worktree's .git file points outside
+# the build context. Without this such builds are stamped "-unk".
+if [ -n "${DRAGONX_BUILD_DESC:-}" ]; then
+    DESC="$DRAGONX_BUILD_DESC"
+elif [ -e "$(which git 2>/dev/null)" -a "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
     # clean 'dirty' status of touched files that haven't been modified
     git diff >/dev/null 2>/dev/null