feat: stamp the build commit, add --version and zap flags, rename module

- module path is now gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator
- internal/version resolves the commit from ldflags or Go build info;
  --version prints it and the first log line carries it
- --metrics-bind-address is passed to the manager instead of being dropped
- Dockerfile takes GIT_COMMIT, honours TARGETARCH, labels the image revision

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-10-08-2028-house-conventions.md

@@ -6,7 +6,7 @@ Plan: `docs/plans/2026-10-08-2028-house-conventions.md`
 - [x] Step 1 — CLAUDE.md
 - [x] Step 2 — `.claude/` and docs scaffolding
 - [x] Step 3 — Makefile, lint, formatting
-- [ ] Step 4 — Module path and version identity
+- [x] Step 4 — Module path and version identity
 - [ ] Step 5 — Baseline tests
 - [ ] Step 6 — CI build workflow
 - [ ] Step 7 — Close out
@@ -84,3 +84,32 @@ Worth noting: this is likely the same failure the egress changelog records as
 `GOTOOLCHAIN` pin should unblock it there. Rebuilding golangci-lint with Go 1.27 is
 the other fix. `.golangci.yml` carries no settings yet: uh-cli's `errcheck`
 exclusions are CLI-specific and nothing here needed one.
+
+## Step 4 — Module path and version identity
+
+Module renamed to `gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator`.
+`internal/version` copied from egress unchanged (code and test). `main.go` gained
+`--version`, a first log line with commit and Go version, the standard `--zap-*`
+flags, and passes `--metrics-bind-address` to the manager.
+
+```
+$ make build && ./bin/manager --version
+0eb588e8bd3a-dirty
+$ make docker-build && docker run --rm gateway-cert-operator:dev --version
+0eb588e8bd3a-dirty
+$ docker inspect gateway-cert-operator:dev --format '{{index .Config.Labels "org.opencontainers.image.revision"}} {{.Config.User}}'
+0eb588e8bd3a-dirty 65532:65532
+```
+
+Deviations from the plan:
+
+- The Dockerfile build also got `-trimpath`, and keeps `-s -w` (egress has neither).
+- The Dockerfile now does `COPY . .` and relies on the new `.dockerignore`
+  allowlist, instead of copying `main.go` and `internal/` by name.
+- The `gozap.AddCaller()` option was kept so log lines look the same as before.
+
+Worth noting: the manager was not started against a cluster in this step; the
+flag wiring is verified by `--help` output and the build only. `GOARCH` defaults to
+`amd64` when `TARGETARCH` is empty (legacy builder, as on the CI runner) and follows
+the host under BuildKit, so a local build on an Apple Silicon machine is arm64.
+`docs/flows.md` still cites pre-change `main.go` line numbers in §2.