The genesis image copies the whole clone with .git, so its controller carried the commit it was built at, as the bundles did.
A module built from its repository's root is compiled with the clone's .git in view, and Go stamped the commit into the binary: a merge that changed only a README made a new digest of an unchanged program.
jochen