feat(build-time-versioning): xce-build.sh computes real commit id/build time

The dev-loop build path (/xce-build, the one behind the motivating
incident) never set -Dcommit_id= at all, so every locally-built binary
carried an empty commit id. xce-build.sh now computes commit_id (git
rev-parse --short HEAD, -dirty suffixed on uncommitted changes, unknown
fallback on a genuine git failure) and build_time (UTC date), appends
both to MESON_OPTS for every profile before meson setup, and warns
loudly to stderr if either ever resolves empty anyway.

Task 2.1/13 of build-time-versioning.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.kiro/specs/build-time-versioning/tasks.md

@@ -7,7 +7,7 @@
   - _Requirements: 1.1, 1.2, 1.4, 4.3_
 
 - [ ] 2. Foundation: compute real values at both build entry points
-- [ ] 2.1 (P) xce-build.sh computes and passes commit id and build time
+- [x] 2.1 (P) xce-build.sh computes and passes commit id and build time
   - Compute `commit_id` via `git rev-parse --short HEAD`, appended with `-dirty` when the tree has uncommitted changes (`git status --porcelain` or `git diff --quiet HEAD --`)
   - Compute `build_time` via `date -u +%Y-%m-%dT%H:%M:%SZ`
   - Fall back to the literal string `unknown` for `commit_id` when `git` itself fails (e.g. no `.git` present)

src/tools/xce-build.sh

@@ -77,6 +77,47 @@ SRC_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
 cd "$SRC_DIR"
 
+# build-time-versioning task 2.1: compute commit_id/build_time once, common to
+# every profile, and append to MESON_OPTS below (before either `meson setup`
+# call in setup_build() runs). This feeds src/meson.options' commit_id/
+# build_time options -> VERSION_COMMIT_ID/VERSION_BUILD_TIME C defines
+# (src/meson.build:30-31). This is the actual fix for the motivating incident:
+# xce-build.sh never set -Dcommit_id= at all, so every local dev-loop build
+# had an EMPTY (not "unknown", not real) commit id -- see
+# .kiro/specs/build-time-versioning/requirements.md Requirement 1/4/5.
+if commit_hash="$(git rev-parse --short HEAD 2>/dev/null)"; then
+    if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
+        commit_id="${commit_hash}-dirty"
+    else
+        commit_id="$commit_hash"
+    fi
+else
+    # git itself failed (e.g. no .git present, extracted source tarball) --
+    # Requirement 1.4: record as unknown rather than fail the build. Still
+    # surface this loudly (distinct from the "resolved truly empty" check
+    # below) -- a genuine git failure must never be silent, even though it
+    # isn't fatal.
+    commit_id="unknown"
+    echo "WARNING: xce-build.sh could not determine commit_id from git (git rev-parse --short HEAD failed) -- falling back to \"unknown\". If this is a real git checkout, investigate; version info for this build will not identify a source commit." >&2
+fi
+build_time="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+# Requirement 4.2: the build tooling must not silently proceed with a value it
+# cannot confirm. build_time should always be non-empty (date never
+# legitimately returns ""); commit_id falls back to the literal "unknown"
+# above only on a genuine git failure -- an empty result here means the
+# computation itself broke in some new way, so warn loudly rather than
+# silently handing meson an empty -Dcommit_id=/-Dbuild_time= (the exact bug
+# this task fixes).
+if [ -z "$commit_id" ]; then
+    echo "WARNING: xce-build.sh could not determine commit_id (resolved empty) -- version info will be missing/incorrect in this build!" >&2
+fi
+if [ -z "$build_time" ]; then
+    echo "WARNING: xce-build.sh could not determine build_time (resolved empty) -- version info will be missing/incorrect in this build!" >&2
+fi
+
+MESON_OPTS+=(-Dcommit_id="$commit_id" -Dbuild_time="$build_time")
+
 usage() {
     echo "Usage: $0 [component] [profile|build_dir] [build_dir] [--incremental]"
     echo "Components: all (default), lib, controller, scheduler, worker, apiserver, xcecli, xceadmin"