feat: stamp the build commit, add --version and zap flags, rename module

- module path is now gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator
- internal/version resolves the commit from ldflags or Go build info;
  --version prints it and the first log line carries it
- --metrics-bind-address is passed to the manager instead of being dropped
- Dockerfile takes GIT_COMMIT, honours TARGETARCH, labels the image revision

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -30,6 +30,7 @@ kubectl kustomize deploy/         # render the manifests
 |---|---|
 | `main.go` | Composition root: scheme, flags, manager, health probes. No leader election. |
 | `internal/controller/certificate_controller.go` | `CertificateReconciler`: watches `Certificate` and `Gateway`, runs the reconcile loop |
+| `internal/version/` | Build commit: ldflags stamp, falling back to Go's VCS build info |
 | `internal/gateway/patch.go` | Pure functions: `BuildListenersFromCertificates`, `MergeListeners`, `ListenersEqual` |
 | `deploy/` | Kustomize manifests; namespace `gateway-cert-operator-system`, single replica |
 
@@ -226,8 +227,8 @@ Gitea Actions, workflows in `.gitea/workflows/`:
 
 ## Gotchas
 
-- **Three names for one project.** Directory `gateway-helper-operator`; git remote and
-  image `gatewayapi-certificates-operator`; binary, manifests, namespace and annotation
+- **Three names for one project.** Directory `gateway-helper-operator`; git remote,
+  Go module and image `gatewayapi-certificates-operator`; binary, manifests, namespace and annotation
   prefix `gateway-cert-operator`.
 - **`listener-port` annotation is not implemented.** `AnnotationListenerPort` is
   declared, never read; every listener is on port 443.
@@ -242,8 +243,12 @@ Gitea Actions, workflows in `.gitea/workflows/`:
   roll out to existing listeners.
 - **`auto-` prefix is the only ownership marker.** A user listener named `auto-…` gets
   deleted.
-- **`--metrics-bind-address` is parsed but ignored**; metrics are still served on
-  controller-runtime's default `:8080`. Logging is hardcoded to zap dev mode.
+- **Logging defaults to zap dev mode** (console encoder, debug level). The deployment
+  does not pass `--zap-devel=false`, so production logs are not JSON.
+- **Version identity is the commit, not a tag.** `--version` and the first log line
+  print the 12-char commit from `internal/version`. Image builds have no `.git` in
+  the context (`.dockerignore`), so the commit arrives through the `GIT_COMMIT`
+  build arg; a plain `docker build` without it reports `unknown`.
 - **`make lint` pins `GOTOOLCHAIN` to the go.mod version.** golangci-lint cannot
   type-check a standard library newer than the Go it was built with, so running
   `golangci-lint run` directly fails when the host Go is ahead of it.