fix: Report a valid version string with unreleased builds

[drewr]

I mostly use datumctl from nix, built from the main branch. That means the version looks like:

% datumctl version
Client Version: v0.0.0-master+$Format:%H$
Kustomize Version: v5.7.1
Server Version: v1.35.0-milo.0.0.0-main-20260827-152801+7f292ebbe69c742d14842af7e3e6a9130226625b
error: client version error: could not parse pre-release/metadata (-master+$Format:%H$) in version "v0.0.0-master+$Format:%H$"

This fixes it to look like:

Client Version: v0.18.2+931f022-dev
[...]

Background

This happens because k8s.io/component-base/version (which backs the version command) was never given a real version via ldflags, so it kept its compiled-in placeholder. The flake's existing git describe fallback for the version was also silently broken: nix flakes always strip .git from the copied source, so it produced dev instead of a real value.

This PR embeds a real, always-valid version in nix builds: the commit sha comes from self.dirtyRev/self.rev (populated by nix's own git metadata, no .git needed), and the last tag comes from an optional untracked VERSION file that task nix-build generates and stages before building (nix flakes only see files git knows about). The result (<tag>+<sha>[-dev]) feeds the k8s.io/component-base/version ldflags, matching what .goreleaser.yaml already does for tagged releases.

The same placeholder shows up building outside nix and outside a release too — a plain go build/go run during local dev. Since ldflags aren't involved there, this adds internal/version.ApplyFallback, called at startup: it detects the placeholder and derives a valid v0.0.0+<sha>[-dev] version from the VCS info Go's toolchain already stamps into the binary automatically. It's a no-op whenever ldflags already provided a real version, so nix and release builds are unaffected. Also drops the flake's -X main.version=... ldflag, which targeted a variable that doesn't exist in package main.

ApplyFallback's runtime patch can never surface a real release tag, though — component-base's SetDynamicVersion rejects any version whose major/minor/patch don't match the compiled-in placeholder's (0.0.0), and Go's VCS stamping has no notion of the nearest tag anyway. So a plain go build always showed v0.0.0 even when a real tag was available. task build closes that gap: it embeds the real <last-tag>+<sha>[-dev] version via ldflags at compile time (same mechanism nix/goreleaser use), so local development builds get a proper version instead of the v0.0.0 fallback.

Test plan

• task nix-build succeeds and embeds git describe --tags's value plus the commit sha
• task build succeeds and embeds the real last tag plus the commit sha
• A plain go build/go run (no ldflags) produces a valid v0.0.0+<sha>[-dev] fallback instead of the placeholder
• datumctl version --client prints a valid version with no parse error, in all three cases
• go test ./... and the nix build's test suite pass
• A dirty working tree produces a -dev suffix, not -dirty

https://claude.ai/code/session_01PKKmeZhi8VV2EcvknMV9Qv