feat: dockerize + switch to hatch-vcs versioning

[Xitee1]

Summary

• hatch-vcs: version is now derived from git tags. __init__.py loads from the generated _version.py with an importlib.metadata fallback for editable installs (and a final 0.0.0+unknown safety net). First v*.*.* tag will give us a proper __version__.
• Dockerfile: python:3.13-slim-bookworm + all runtime tools listed in CLAUDE.md (dar, par2, genisoimage, growisofs, dvd+rw-tools, udisks2, lsof, eject, mount). Version is injected via SETUPTOOLS_SCM_PRETEND_VERSION build-arg, so .git/ does not need to be in the build context (which keeps the context small and avoids the usual hatch-vcs-in-Docker pitfalls).
• GH Action: triggers on v*.*.* tag push. Builds linux/amd64 + linux/arm64 via Buildx + QEMU and publishes to ghcr.io/xitee1/bd-archiver with semver tag fan-out (5.0.0, 5.0, 5, latest for the highest stable).

Notes

• Tag format must be PEP 440-compatible. v5.0.0 and v5.0.0rc1 work; v5.0.0-rc1 (SemVer-style hyphenated prerelease) would fail the Docker build because hatch-vcs takes the string verbatim.
• After this PR is merged, pushing a v5.0.0 tag should produce the first published image at ghcr.io/xitee1/bd-archiver:5.0.0 (+ 5.0, 5, latest).

Test plan

• pip install -e '.[dev]' regenerates _version.py; bd-archive --version shows a dynamic dev version (no hardcoded 5.0.0)
• git status shows _version.py as ignored
• docker build --build-arg BD_ARCHIVE_VERSION=9.9.9 . succeeds; docker run --rm <img> --version prints bd-archive 9.9.9
• All 10 expected runtime binaries resolve inside the container (dar, par2, mkisofs, growisofs, dvd+rw-mediainfo, udisksctl, lsof, eject, mount, umount)
• ruff check + ruff format --check pass
• Post-merge: push v5.0.0 tag, watch the workflow, verify image appears at ghcr.io/xitee1/bd-archiver:5.0.0

🤖 Generated with Claude Code