feat: stamp the build commit, add --version and zap flags, rename module

- module path is now gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator
- internal/version resolves the commit from ldflags or Go build info;
  --version prints it and the first log line carries it
- --metrics-bind-address is passed to the manager instead of being dropped
- Dockerfile takes GIT_COMMIT, honours TARGETARCH, labels the image revision

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/flows.md

@@ -52,11 +52,8 @@ process start
          ├─ ctrl.GetConfigOrDie()       # KUBECONFIG or in-cluster config
          │      on err ──► os.Exit(1)
          │
-         ├─ ctrl.NewManager(cfg, Options{Scheme, HealthProbeBindAddress: ":8081"})
+         ├─ ctrl.NewManager(cfg, Options{Scheme, Metrics, HealthProbeBindAddress})
          │      on err ──► log + os.Exit(1)                            [main.go:44-47]
-         │      NOTE: metricsAddr is parsed above but NOT passed here;
-         │            the manager falls back to its own default, which
-         │            is also ":8080" (see §10, item 2)
          │
          ├─ controller.SetupCertificateReconciler(mgr)                  [main.go:53]
          │      registers field index + watches (see §3)
@@ -469,8 +466,8 @@ Recorded as-found. None are fixed by this document.
 **1. `AnnotationListenerPort` is dead code**
 `certificate_controller.go:25` declares the constant; `BuildListenersFromCertificates` (`patch.go:44`) always uses `defaultPort = 443`. Setting `gateway-cert-operator.io/listener-port` on a Certificate has no effect.
 
-**2. `--metrics-bind-address` flag is parsed but not wired**
-`main.go:32` parses the flag; `main.go:44-47` never passes `MetricsBindAddress` to `ctrl.Options`. controller-runtime defaults an empty bind address to `:8080`, so metrics are served and the Service in `deploy/service_gateway-cert-operator-metrics.yaml` works; only changing the flag has no effect.
+**2. `--metrics-bind-address` flag was not wired** (fixed)
+The flag used to be parsed and dropped; metrics were served anyway because controller-runtime defaults an empty bind address to `:8080`. `main.go` now passes it through `metricsserver.Options`.
 
 **3. No finalizer → cert deletion leaves stale listeners**
 When a Certificate is deleted, Reconcile returns early at branch (A) with no cluster write. The stale `auto-*` listener persists in the Gateway until a sibling event triggers re-convergence (see Scenario 4 above), or permanently if no other Certificate targets that Gateway. Adding a finalizer to the Certificate would close this gap by allowing cleanup before the object is removed from the API server.

docs/plans-executions/2026-10-08-2028-house-conventions.md

@@ -6,7 +6,7 @@ Plan: `docs/plans/2026-10-08-2028-house-conventions.md`
 - [x] Step 1 — CLAUDE.md
 - [x] Step 2 — `.claude/` and docs scaffolding
 - [x] Step 3 — Makefile, lint, formatting
-- [ ] Step 4 — Module path and version identity
+- [x] Step 4 — Module path and version identity
 - [ ] Step 5 — Baseline tests
 - [ ] Step 6 — CI build workflow
 - [ ] Step 7 — Close out
@@ -84,3 +84,32 @@ Worth noting: this is likely the same failure the egress changelog records as
 `GOTOOLCHAIN` pin should unblock it there. Rebuilding golangci-lint with Go 1.27 is
 the other fix. `.golangci.yml` carries no settings yet: uh-cli's `errcheck`
 exclusions are CLI-specific and nothing here needed one.
+
+## Step 4 — Module path and version identity
+
+Module renamed to `gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator`.
+`internal/version` copied from egress unchanged (code and test). `main.go` gained
+`--version`, a first log line with commit and Go version, the standard `--zap-*`
+flags, and passes `--metrics-bind-address` to the manager.
+
+```
+$ make build && ./bin/manager --version
+0eb588e8bd3a-dirty
+$ make docker-build && docker run --rm gateway-cert-operator:dev --version
+0eb588e8bd3a-dirty
+$ docker inspect gateway-cert-operator:dev --format '{{index .Config.Labels "org.opencontainers.image.revision"}} {{.Config.User}}'
+0eb588e8bd3a-dirty 65532:65532
+```
+
+Deviations from the plan:
+
+- The Dockerfile build also got `-trimpath`, and keeps `-s -w` (egress has neither).
+- The Dockerfile now does `COPY . .` and relies on the new `.dockerignore`
+  allowlist, instead of copying `main.go` and `internal/` by name.
+- The `gozap.AddCaller()` option was kept so log lines look the same as before.
+
+Worth noting: the manager was not started against a cluster in this step; the
+flag wiring is verified by `--help` output and the build only. `GOARCH` defaults to
+`amd64` when `TARGETARCH` is empty (legacy builder, as on the CI runner) and follows
+the host under BuildKit, so a local build on an Apple Silicon machine is arm64.
+`docs/flows.md` still cites pre-change `main.go` line numbers in §2.