Sanitize branch-derived Docker tag in Makefile targets

[DavidJBianco]

Motivation

• Prevent command injection by avoiding unquoted expansion of the current git branch in Makefile shell recipes used for Docker image tags.

Description

• Add a DOCKER_TAG variable that derives the branch name via git branch --show-current and normalizes it with tr -c '[:alnum:]._-' '-' to a Docker-tag-safe character set.
• Replace direct uses of $(shell git branch --show-current) in the container-local and container-run targets with $(DOCKER_TAG).

Testing

• Ran dry-run checks with make -n container-local and make -n container-run and confirmed both commands emit the sanitized $(DOCKER_TAG) image tag.
• Both dry-run invocations completed successfully.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 30eb48b686

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Trim branch newline before sanitizing Docker tag

git branch --show-current emits a trailing newline, and at this line tr -c '[:alnum:]._-' '-' converts that newline into -, so every computed tag becomes <branch>- (for example, work-), not the intended sanitized branch name. This changes the image tag unexpectedly for all container-local/container-run invocations and can break scripts or expectations that rely on branch-aligned tags; trim the newline first (or strip trailing dashes after transliteration).

Useful? React with 👍 / 👎.

[DavidJBianco]

Merged into dev via #84 (batch-a-quick-fixes, commit bd1ab9d).