Version is set at build time via -ldflags. The Makefile populates
it with `git describe --tags --always --dirty`, producing values
like "v0.4.1" for a clean tagged build and
"v0.4.1-7-gabcd123-dirty" for in-development work past a tag.
When it is left at its "dev" default (plain `go build`, or
`go install …@vX.Y.Z` which ignores ldflags), resolvedVersion()
falls back to runtime build info so installs from a pinned tag
still show that tag instead of "dev". Builds off main without a
tag will continue to show "dev" with a pseudo-version appended.
ExitError is a typed error that carries a process exit code, so that
main.go can translate a command failure into the right exit status
without re-encoding error categories as strings.