flake.nix reads from VERSION instead of hardcoding; Makefile gains a version target that syncs VERSION from the latest git tag and injects it into go build ldflags. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
