fix(iso): add git safe.directory so git describe sees v* tags inside container

Without this, git refuses to read the bind-mounted repo (UID mismatch)
and describe returns empty, causing the version to fall back to iso/v1.0.20.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/build.sh

@@ -28,6 +28,9 @@ done
 
 . "${BUILDER_DIR}/VERSIONS"
 export PATH="$PATH:/usr/local/go/bin"
+
+# Allow git to read the bind-mounted repo (different UID inside container).
+git config --global safe.directory "${REPO_ROOT}"
 mkdir -p "${DIST_DIR}"
 mkdir -p "${CACHE_ROOT}"
 : "${GOCACHE:=${CACHE_ROOT}/go-build}"