Build-time version metadata is injected via -ldflags but never referenced; no --version flag

[dolph]

Summary

build.sh injects seven build-time identifiers into the main package via go build -ldflags -X:

-X 'main.GitTag=$GIT_TAG'
-X 'main.GitCommit=$GIT_COMMIT'
-X 'main.GoVersion=$GO_VERSION'
-X 'main.BuildTimestamp=$BUILD_DATE'
-X 'main.BuildOS=$OSTYPE'
-X 'main.BuildArch=$BUILD_ARCH'
-X 'main.BuildTainted=$BUILD_TAINTED'

None of these symbols exist anywhere in the source tree:

$ grep -n 'GitTag\|GitCommit\|GoVersion\|BuildTimestamp\|BuildOS\|BuildArch\|BuildTainted' *.go
# (no output)

go build silently accepts -X flags that reference unknown package-level variables, so the build "succeeds" but the metadata is dropped on the floor. Additionally there is no --version, -v, --help, or -h flag — the only output is log.Fatal("Usage: find-replace FIND REPLACE") when arg count is wrong.

Impact (Operability/CLI: Medium)

• Operators answering an alert at 3am cannot identify which version is installed.
• The release workflow (.github/workflows/release.yml) does not pass these ldflags at all — it uses -ldflags="-s -w" — so even after wiring them up, dev builds and release builds will diverge unless build.sh and release.yml are unified.
• --help discoverability is broken; users hit log.Fatal instead of clean help text.

Suggested Fix

1. Declare the package-level variables in a new version.go:

   package main
   var (
       GitTag         = "(dev)"
       GitCommit      = "(unknown)"
       GoVersion      = "(unknown)"
       BuildTimestamp = "(unknown)"
       BuildOS        = "(unknown)"
       BuildArch      = "(unknown)"
       BuildTainted   = "(unknown)"
   )

2. Add --version / -v and --help / -h flag handling at the top of main (use flag package or hand-roll given the simple usage).

3. Unify build.sh and release.yml so the release binary is also stamped with the metadata.

Files

• build.sh:8-28
• .github/workflows/release.yml:121-130
• find_replace.go:29-50 (main)