main.go's version var now defaults to "dev" for local builds and is
overridden at build time via -ldflags "-X main.version=...". The
release workflow computes VERSION with `git describe --tags --always
--dirty` (fetch-depth: 0 so tags are available) and injects it into
the Go build inside the container.
