feat: embed git SHA in version string via build.rs

Adds a build.rs that runs `git describe --tags --always --dirty` and
sets NUMA_BUILD_VERSION at compile time. A new `numa::version()` helper
returns the build version, falling back to CARGO_PKG_VERSION when git
is unavailable (source tarballs, Docker builds without .git).

Version strings:
  tagged release:      0.13.1
  commits ahead:       0.13.1+a87f907
  uncommitted changes: 0.13.1+a87f907-dirty
  no git:              0.13.1

Replaces all 6 inline env!("CARGO_PKG_VERSION") call sites with the
single version() function.

src/api.rs

@@ -540,7 +540,7 @@ async fn stats(State(ctx): State<Arc<ServerCtx>>) -> Json<StatsResponse> {
     };
 
     Json(StatsResponse {
-        version: env!("CARGO_PKG_VERSION"),
+        version: crate::version(),
         uptime_secs: snap.uptime_secs,
         upstream,
         mode: ctx.upstream_mode.as_str(),

src/health.rs

@@ -43,7 +43,7 @@ impl HealthMeta {
     #[cfg(test)]
     pub fn test_fixture() -> Self {
         HealthMeta {
-            version: env!("CARGO_PKG_VERSION"),
+            version: crate::version(),
             hostname: "test-host".to_string(),
             sni: "numa.numa".to_string(),
             dot_enabled: false,
@@ -99,7 +99,7 @@ impl HealthMeta {
         }
 
         HealthMeta {
-            version: env!("CARGO_PKG_VERSION"),
+            version: crate::version(),
             hostname: crate::hostname(),
             sni: "numa.numa".to_string(),
             dot_enabled,

src/lib.rs

@@ -34,6 +34,14 @@ pub(crate) mod testutil;
 pub type Error = Box<dyn std::error::Error + Send + Sync>;
 pub type Result<T> = std::result::Result<T, Error>;
 
+/// Build version string. On tagged releases: `0.13.1`. On commits ahead
+/// of a tag: `0.13.1+a87f907`. With uncommitted changes: `0.13.1+a87f907-dirty`.
+/// Falls back to `CARGO_PKG_VERSION` when built outside a git repo (e.g.
+/// from a source tarball).
+pub fn version() -> &'static str {
+    option_env!("NUMA_BUILD_VERSION").unwrap_or(env!("CARGO_PKG_VERSION"))
+}
+
 /// Detect the machine hostname via the `hostname` command. Returns the
 /// full hostname (e.g., `macbook-pro.local`), or `"numa"` if the command
 /// fails. Call sites that need the short form (e.g., mDNS instance

src/main.rs

@@ -72,7 +72,7 @@ async fn main() -> numa::Result<()> {
             };
         }
         "version" | "--version" | "-V" => {
-            eprintln!("numa {}", env!("CARGO_PKG_VERSION"));
+            eprintln!("numa {}", numa::version());
             return Ok(());
         }
         "help" | "--help" | "-h" => {
@@ -383,12 +383,10 @@ async fn main() -> numa::Result<()> {
     };
 
     // Title row: center within the box
-    let title = format!(
-        "{b}NUMA{r}  {it}DNS that governs itself{r}  {d}v{}{r}",
-        env!("CARGO_PKG_VERSION")
-    );
+    let ver = numa::version();
+    let title = format!("{b}NUMA{r}  {it}DNS that governs itself{r}  {d}v{ver}{r}",);
     // The title contains ANSI codes; visible length is ~38 chars. Pad to fill the box.
-    let title_visible_len = 4 + 2 + 24 + 2 + 1 + env!("CARGO_PKG_VERSION").len() + 1;
+    let title_visible_len = 4 + 2 + 24 + 2 + 1 + ver.len() + 1;
     let title_pad = w.saturating_sub(title_visible_len);
     eprintln!("\n{o}  ╔{bar_top}╗{r}");
     eprint!("{o}  ║{r} {title}");