Log build info on startup in every run mode (#406)

Emit a single "Duckgres build info." slog line right after logging is
initialized, tagged with the run mode (standalone / control-plane /
duckdb-service / ...). This makes it trivial to grep a K8s worker's
logs and confirm which image it's actually running — especially useful
when correlating a bug to a specific commit across many worker pods.

version/commit/date have existed as ldflag-set package vars for a while
(Dockerfile, release workflow and justfile all pass -X flags), but only
the standalone path referenced them, and only `version`. The control
plane and duckdb-service workers never surfaced build info at all.

The ldflags-based flow stays authoritative. When the binary is built
without ldflags (local `go run`, `go build`, editor runs) enrichBuildInfo
backfills commit and date from runtime/debug.BuildInfo VCS settings
(Go 1.18+ embeds these automatically from the surrounding git checkout)
and appends "-dirty" when vcs.modified is true. The fallback only fires
when ldflags left the sentinel values in place — a release-built binary
with an explicit -X main.commit never gets mutated.

Verified locally:
  - go build -ldflags "-X main.version=1.2.3 -X main.commit=deadbeef ..."
    → "duckgres version 1.2.3 (commit: deadbeef, built: ...)"
  - plain go build
    → "duckgres version dev (commit: 815063d-dirty, built: ...)"

And the log line appears as the first INFO line under --mode
duckdb-service and --mode control-plane.

Author: benben

main.go

@@ -359,6 +359,8 @@ func main() {
 	loggingShutdown := initLogging()
 	defer loggingShutdown()
 
+	logBuildInfo(*mode)
+
 	if fileCfg != nil {
 		slog.Info("Loaded configuration from " + *configFile)
 	}

version.go

@@ -1,13 +1,78 @@
 package main
 
-import "fmt"
+import (
+	"fmt"
+	"log/slog"
+	"runtime/debug"
+	"sync"
+)
 
+// version, commit and date are populated at link time via -ldflags -X by the
+// Dockerfile, justfile and release workflow. When the binary is built without
+// those flags (local `go run`/`go build`), enrichBuildInfo backfills commit
+// and date from runtime/debug.BuildInfo VCS settings, which the go toolchain
+// embeds automatically from the local git checkout (Go 1.18+). ldflags values
+// always win — the fallback only fires when the default sentinel is still set.
 var (
 	version = "dev"
 	commit  = "unknown"
 	date    = "unknown"
 )
 
+var enrichBuildInfoOnce sync.Once
+
+func enrichBuildInfo() {
+	enrichBuildInfoOnce.Do(func() {
+		info, ok := debug.ReadBuildInfo()
+		if !ok {
+			return
+		}
+		// Only backfill commit from VCS when ldflags did not provide one.
+		// The dirty marker is scoped to the VCS-backfilled case too — if
+		// ldflags injected a commit, the release pipeline owns that value
+		// and we should not mutate it.
+		commitFromVCS := commit == "unknown"
+		var dirty bool
+		for _, s := range info.Settings {
+			switch s.Key {
+			case "vcs.revision":
+				if commitFromVCS && s.Value != "" {
+					commit = s.Value
+					if len(commit) > 12 {
+						commit = commit[:12]
+					}
+				}
+			case "vcs.time":
+				if date == "unknown" && s.Value != "" {
+					date = s.Value
+				}
+			case "vcs.modified":
+				if s.Value == "true" {
+					dirty = true
+				}
+			}
+		}
+		if dirty && commitFromVCS && commit != "unknown" {
+			commit += "-dirty"
+		}
+	})
+}
+
 func versionString() string {
+	enrichBuildInfo()
 	return fmt.Sprintf("duckgres version %s (commit: %s, built: %s)", version, commit, date)
 }
+
+// logBuildInfo emits a single startup line identifying the binary's version,
+// git commit and build time, tagged with the run mode. Call once per process
+// at startup so log readers can quickly correlate behavior with a specific
+// build, especially in K8s where worker pods inherit the control plane image.
+func logBuildInfo(mode string) {
+	enrichBuildInfo()
+	slog.Info("Duckgres build info.",
+		"mode", mode,
+		"version", version,
+		"commit", commit,
+		"built", date,
+	)
+}