The builder stage lacks jj, so build.rs fell back to "unknown" and
produced versions like `2026-05-06+unknown-dev`. Pass the tag as a
build-arg instead.

Assisted-by: Claude Opus 4.7 via Claude Code

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 45a4eaf..a9f7047 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -75,6 +75,8 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            QUIRE_VERSION=${{ steps.meta.outputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
       - env:
diff --git a/Dockerfile b/Dockerfile
index 2a9b5fb..221efe8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,6 +43,8 @@ RUN cargo chef prepare --recipe-path recipe.json
 # Build stage: cook dependencies first (cached across rebuilds), then build
 # the binary. Changes to source code do not retrigger dependency compilation.
 FROM chef AS builder
+ARG QUIRE_VERSION
+ENV QUIRE_VERSION=${QUIRE_VERSION}
 COPY --from=planner /build/recipe.json recipe.json
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git/db \
diff --git a/build.rs b/build.rs
index 21a6237..6b25ac2 100644
--- a/build.rs
+++ b/build.rs
@@ -1,6 +1,7 @@
 use std::process::Command;
 
 fn main() {
+    println!("cargo:rerun-if-env-changed=QUIRE_VERSION");
     let version = std::env::var("QUIRE_VERSION").unwrap_or_else(|_| {
         let date = cmd("date", &["-u", "+%Y-%m-%d"]);
         let change = cmd(