fix(release): let git read the tree mounted into the release container

- `make release` failed at once with "current folder is not a git repository". Docker Desktop showed the mounted tree's top directory as owned by root while the build runs as the calling user, so git refused the repository as dubiously owned and GoReleaser could not read the tag.
- The release and snapshot containers now name `/src` as a `safe.directory` through git's `GIT_CONFIG_*` environment variables, which needs no configuration file in the image or the tree.

Makefile

@@ -20,6 +20,8 @@ BUILD_ID := $(shell uuidgen | tr '[:upper:]' '[:lower:]')
 # the full and headless builds of one target share. Cargo still builds each in parallel.
 # Docker creates a missing volume owned by root, so the volume is handed to the build's user
 # first; otherwise a release after make clean cannot write to target/.
+# Docker Desktop can show the mounted tree's top directory as root's, which git refuses as
+# "dubious ownership" and GoReleaser reports as "not a git repository", so the tree is named safe.
 GORELEASER = mkdir -p $(CARGO_CACHE) && docker run --rm \
 	--user 0:0 \
 	--entrypoint chown \
@@ -29,6 +31,9 @@ GORELEASER = mkdir -p $(CARGO_CACHE) && docker run --rm \
 	--user $(shell id -u):$(shell id -g) \
 	-e CARGO_HOME=/cargo-home \
 	-e HOME=/tmp \
+	-e GIT_CONFIG_COUNT=1 \
+	-e GIT_CONFIG_KEY_0=safe.directory \
+	-e GIT_CONFIG_VALUE_0=/src \
 	-e MIDI_HARBOR_MAINTAINER="$(MIDI_HARBOR_MAINTAINER)" \
 	-e MIDI_HARBOR_VERSION="$(VERSION)" \
 	-e MIDI_HARBOR_BUILD_ID="$(BUILD_ID)" \