Stamp source builds from the release tag and add an e2e suite on the built binary

[guygrigsby]

Source builds now report the release tag instead of a commit count. make build, make install and a plain go build all stamped B<n> (the commit height), so a running binary could not be matched to the release it came from. Goreleaser already stamps {{.Tag}}, so the height scheme only ever showed on dev builds. That is every build a dev runs.

Both the Makefile ldflags and the init() fallback in cmd/aperture/main.go now use git describe --tags --always --dirty. A release commit reports v0.0.12, a commit past it reports v0.0.12-3-g492405b and a modified tree gets -dirty. Nothing parses the version string (-version, the run log and the TUI footer only print it), so the format change is display only.

Also adds an e2e package that drives the built binary. Every existing test ran internals in-process, so the flag-before-TUI ordering, the PTY handoff to a launched agent and the return to the picker after the child exits were untested where users hit them. TestMain builds the binary once and four tests run it for real:

• -version prints a release version.
• A bad endpoint fails on stderr with exit code 1 before the TUI takes the terminal.
• The Pi happy path: a fake Aperture (httptest serving /v1/models) and a stub pi on PATH that records its argv and copies the generated provider extension while it still exists. The test checks the extension routes back to the fake Aperture and that q quits cleanly after the child exits.
• An unreachable endpoint paints the "Could not reach" banner instead of hanging or exiting.

Runs are hermetic. HOME and XDG_CONFIG_HOME point at a temp dir. PATH is the stub dir plus /usr/bin and /bin only, so host agent binaries stay out of the picker. TERM=dumb because startup asks the terminal its color profile and a PTY never answers, which cost every run a five second timeout under xterm. creack/pty is promoted from the module graph, no new third-party code. The package sits under ./..., so make check and CI pick it up with no wiring. AGENTS.md now asks for unit and e2e tests with all new functionality.

Risks:

• The CI checkout is shallow with no tags, so make build there stamps a bare short hash and TestVersion only asserts the value is not B0-dev. Tagged releases are unaffected because release.yaml fetches with depth 0. fetch-depth: 0 in ci-linux.yaml would make CI match a dev box.
• The hermetic PATH is /usr/bin and /bin. A box with git or sh somewhere else (Nix, for one) fails TestVersion, because a plain go build has no version source without git and stays B0-dev.
• The suite needs a PTY, so it is Unix only. There is no Windows CI today, and adding one would need a build tag or a skip on the package.
• Bridge flows, install flows and Windows PTYs are not covered. Bridges need a control plane and installs need the network.