fix: --version no longer false-positives -dirty on clean release installs

The build-time dirty check used `git status --porcelain`, which counts
untracked files — including cargo's own `.cargo-ok` marker in a
`cargo install --git` checkout — so a clean tagged build reported e.g.
`1.0.1 (bcab3c16b-dirty)`. Use `git diff --quiet HEAD` (tracked changes only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/heph-core/build.rs

@@ -35,10 +35,14 @@ fn git_short_sha() -> Option<String> {
     if sha.is_empty() {
         return None;
     }
-    let dirty = Command::new("git")
-        .args(["status", "--porcelain"])
-        .output()
-        .map(|o| !o.stdout.is_empty())
-        .unwrap_or(false);
+    // Tracked changes only. `git status --porcelain` would also count
+    // untracked files — including cargo's own `.cargo-ok` marker in a
+    // `cargo install --git` checkout — and falsely tag a clean release build
+    // `-dirty`. `git diff --quiet HEAD` exits non-zero only on tracked edits.
+    let dirty = !Command::new("git")
+        .args(["diff", "--quiet", "HEAD"])
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(true);
     Some(if dirty { format!("{sha}-dirty") } else { sha })
 }

docs/changelog.d/+version-no-false-dirty.bugfix.md

@@ -0,0 +1 @@
+Fix `heph`/`hephd` `--version` falsely showing a `-dirty` suffix on clean release installs. The build-time dirty check now considers only tracked modifications (`git diff --quiet HEAD`) instead of counting untracked files such as cargo's own `.cargo-ok` marker in a `cargo install --git` checkout.