New package github.com/dagger/dagger/version owns the Dagger build's
identity at runtime:

- semantic version embedded from version/VERSION via //go:embed
- commit/dirty/time read from runtime/debug build info, wrapped by
  github.com/dagger/go/buildinfo to leave room for ldflags injection
  from sandboxed builds in a follow-up
- exposes Canonical() returning "X.Y.Z+abc12345[.dirty]" per discussion #13287

dagger version output now follows the discussion format:

  $ dagger version
  version: 0.21.3
  commit:  0bbaf39
  dirty:   yes

  $ dagger version -q
  0.21.3+0bbaf39f.dirty

engine.Version / engine.Tag and the --check / update-available flow are
untouched here; they get migrated in P1.3 / P5.

buildinfo is pulled in via a local replace until it ships a tag in the
dagger/go repo.

Signed-off-by: Solomon Hykes <solomon@dagger.io>

runtime/debug.ReadBuildInfo().Settings returns the *main module's* VCS
info, never an imported module's. The version package fuses Dagger's
embedded semver with whatever vcs.* the toolchain stamped — that fusion
is only meaningful when the binary being built is itself a Dagger binary.

Marking it internal/ blocks external consumers at compile time, so any
third-party importer can't accidentally read "0.21.3 + my-own-binary's
commit hash" and mistake it for Dagger's identity.

Signed-off-by: Solomon Hykes <solomon@dagger.io>

engine.Version and engine.Tag remain the public API every callsite uses.
They're no longer ldflags-injected — init() reads from internal/version
(which embeds VERSION and wraps runtime/debug for VCS info):

  Version = "v" + iversion.Version
  Tag     = iversion.Commit if known, else Version

The "v" prefix matches the semver convention this codebase already
threads through golang.org/x/mod/semver. The Tag fallback matches the
existing convention where dev/main builds tag the engine image by
commit and releases tag it by version.

DAGGER_VERSION / DAGGER_TAG / DAGGER_MINIMUM_VERSION env-var overrides
still work for tests (unchanged). Minimum-version capping also unchanged.

cli-dev/engine-dev still pass -X engine.Version / engine.Tag ldflags —
those become no-ops now (the vars get overwritten by init from
internal/version). P1.4 removes the ldflags injection from those
toolchains. P2 wires sandbox builds to inject via buildinfo's
Injected* vars instead, so sandbox builds self-report VCS correctly.

Signed-off-by: Solomon Hykes <solomon@dagger.io>

The version module is gone (commit 0bbaf39) and engine.Version is now
populated from the embedded VERSION file via internal/version (commit
f15863e). The -X engine.Version / -X engine.Tag ldflags the toolchains
were still passing became no-ops the moment P1.3 landed — init()
overwrites those vars unconditionally.

- toolchains/cli-dev/main.go: drop dag.Version()/dag.Version().ImageTag()
  fallback, drop the ldflags. CliDev.Version is whatever the caller
  passes; publish flow callers still set it explicitly for goreleaser
  ENGINE_VERSION / semver gating / S3 paths. The built binary
  self-reports correctly from embedded VERSION regardless.

- toolchains/engine-dev/main.go: drop dag.Version() lookup in Service;
  use the existing version parameter directly for cache volume naming,
  fall back to random when empty (existing behavior).

- toolchains/engine-dev/test.go: drop the ldflags injection block
  entirely — it was already a no-op. Drop "strings" import.

- toolchains/release/tests.go: TestLocalRelease gains a required
  version parameter (was reading via dag.Version()). gen.go updated
  manually; next `dagger develop` will regenerate cleanly.

- toolchains/engine-dev/build/builder.go: drop dag.Version() and
  ldflags injection block entirely.

Sandbox-built binaries still report empty commit/dirty until P2 wires
buildinfo's Injected* vars through cli-dev's go build invocation.

Signed-off-by: Solomon Hykes <solomon@dagger.io>

Add an auto-acquired *dagger.GitRepository input to the Go builder's New
constructor. When present (default: the workspace root), read HEAD commit
and uncommitted state, and append -X github.com/dagger/go/buildinfo.Injected*=
values to the -ldflags pipeline.

Binaries that import buildinfo (transitively via
github.com/dagger/dagger/internal/version, after P1) self-report VCS info
through runtime/debug.ReadBuildInfo without needing .git inside the build
container.

GitRepository was chosen over a Directory input because it's lazier — no
full repo upload, the engine fetches only what GraphQL operations actually
need. The dirty signal uses GitRepository.uncommitted, which the engine
already implements with the right gitignore semantics.

Inspection errors are swallowed silently — builds proceed without VCS info
rather than aborting (matches the deleted version/ module's failure mode).

TODO: switch to Workspace.git (PR #13074) when Dagger >= 1.0.0-beta.2.
It's lazier still, supports nested workspaces cleanly, and will expose
commit time once the GitCommit proposal (#13086) lands.

No caller changes needed: cli-dev/engine-dev/release continue calling
dag.Go(GoOpts{...}) unchanged. The new input auto-acquires from the
workspace root at module-call time. dagger.gen.go for consumers will pick
up the new optional field next time they run `dagger develop`.

Signed-off-by: Solomon Hykes <solomon@dagger.io>

buildinfo lives at github.com/dagger/go/buildinfo on the dagger/go
default branch as of bcbbfc7. Switch from the local-checkout replace
directive (added in P1.2 as a temporary hold) to the real pseudo-version.

The // indirect marker is cosmetic — internal/version imports it
directly. `go mod tidy` errored partway on an unrelated querybuilder
snippet import before reaching the direct/indirect classification; a
follow-up tidy in a clean tree will fix the label.

Signed-off-by: Solomon Hykes <solomon@dagger.io>

Signed-off-by: Solomon Hykes <solomon@dagger.io>