Add --strict flag to build and push commands

When set, --strict rejects builds/pushes where the working tree is
dirty or HEAD is not exactly on a git tag. Ensures image tags in
the registry always match clean git tags.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

push.go

@@ -8,6 +8,7 @@ import (
 
 func pushCommand() *cobra.Command {
 	var imageFlag string
+	var strict bool
 
 	cmd := &cobra.Command{
 		Use:   "push <service>",
@@ -26,9 +27,9 @@ func pushCommand() *cobra.Command {
 
 			svcPath := cfg.ServicePath(svc)
 
-			version, err := runOutput(svcPath, "git", "describe", "--tags", "--always", "--dirty")
+			version, err := serviceVersion(svcPath, strict)
 			if err != nil {
-				return fmt.Errorf("git describe in %s: %w", svcPath, err)
+				return err
 			}
 			fmt.Printf("Version: %s\n", version)
 
@@ -63,5 +64,6 @@ func pushCommand() *cobra.Command {
 	}
 
 	cmd.Flags().StringVar(&imageFlag, "image", "", "push only this image")
+	cmd.Flags().BoolVar(&strict, "strict", false, "require clean git tag (no dirty tree, no commit offset)")
 	return cmd
 }