Build published images with the version they report

publish.yml passed the computed version into the image build, and the
first port of it to GitLab CI did not. A tag pushed with that port would
have shipped an image reporting itself unversioned (or, for ihasvpn, with a
stray leading "v" no earlier build had), and tagged it with the git tag
rather than the version string.

The version is now computed the way publish.yml computed it and passed as
the build arg, and the image is tagged with it, '+' turned into '-' where a
Docker tag needs that.

.gitlab-ci.yml

@@ -76,6 +76,11 @@ docker-build:
 # through QEMU instead -- slower, but this is tag-driven and the alternative is
 # shipping amd64 only, which is what the account suspension already cost us
 # once. TrueNAS and Unraid users pull arm64.
+#
+# The version is the tag without its leading "v". publish.yml used
+# `git describe --tags --always`, which on a tag pipeline is exactly the tag;
+# the first port passed the tag with the "v" still on, so /api/health would
+# have reported a different string from every earlier build.
 publish:
   stage: publish
   image: docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d # 28-cli
@@ -88,9 +93,9 @@ publish:
     - |
       docker buildx build \
         --platform linux/amd64,linux/arm64 \
-        --build-arg IHASVPN_VERSION="$CI_COMMIT_TAG" \
+        --build-arg IHASVPN_VERSION="${CI_COMMIT_TAG#v}" \
         --provenance=false --sbom=false \
-        --tag "$IMAGE:$CI_COMMIT_TAG" \
+        --tag "$IMAGE:${CI_COMMIT_TAG#v}" \
         --tag "$IMAGE:latest" \
         --push .
   after_script: