fix: derive build version from Git provenance

[pigmej]

Summary

• Replace the stale runtime version with a Nim compile-time string override; inject Git tag/distance/hash/dirty provenance into release and debug builds.
• Support command-line/environment OCDEV_VERSION overrides and dev fallback without usable Git metadata. Invoke Nim on every build to refresh provenance through its compiler cache.
• Fetch full CI history, assert release tag/version agreement, and preserve stripped artifacts during size checks. Correct Nimble package metadata to 0.3.0 and document the build contract.
• Add isolated regression tests using the real Makefile and config constant, integrated into make test and make test-version.

Verification

• make test-version — PASS: tagless/exact-tag/distance/tag changes, dirty→clean, untracked files, literal overrides and precedence on release/debug, archive/nested archive/unborn/missing-Git fallbacks, direct Nim fallback, worktree .git file, post-strip artifact preservation.
• make test — PASS: complete offline suite, no live Incus daemon.
• make all bin/ocdev-debug — PASS before and after commit; both post-commit binaries report v0.3.0-1-g044f11c, matching git describe --tags --always --dirty.
• Release/debug --help and git diff --check — PASS.
• Independent local implementation review using cpa/gpt-6-astra, thinking high — APPROVED; no actionable findings.

Only the seven intended source/build/test/docs files are included. Existing untracked files and the installed executable were not changed; no tags, release assets, or containers were modified.