test: disable Go's test cache so every run queries live DNS (closes #139)

`script/test` did not pass `-count=1`, so on an unchanged tree Go
served the whole suite from its test cache: exit 0 in ~0.2s with every
package marked `(cached)` and not one DNS query made. This repo's suite
exists to exercise live resolution on every run (`TESTING.md`), so that
green asserted nothing — and it is exactly the green used as evidence
that a flakiness fix works, since "run it a few times" stops being
runs after the first.

`-count=1` now disables caching on every invocation.

The conditional verbose rerun that `REPO_POLICIES.md` mandates was
missing at the same spot and is added here rather than left broken: the
primary run had been unconditionally `-v`, which is the failure mode
the policy exists to prevent (unreadable CI and `docker build` logs on
success). Tests now run quiet, and only a failure triggers the `-v`
rerun. The rerun carries `-count=1` too, so it cannot replay a cached
copy of the failure it is meant to diagnose, and its exit status is
discarded in favour of a forced 1: the first failure already proved the
suite broken, so a flake that passes the second time must not turn the
build green.

`-timeout 90s` is untouched. It is a deliberate backstop that must
strictly exceed the 60s hard cap on suite duration.

No special-casing for the Docker build, which also reaches this script
via `RUN make test`: a fresh container's test cache is empty, so
`-count=1` changes nothing there and carving out an exception would
only create a second code path that could drift.

Verified: three back-to-back `make test` runs on an unchanged tree,
zero `(cached)` markers, ~4.0-4.5s wall each (was ~0.2s cached),
comfortably inside the 20s target with `-race` and `-cover` both still
working and coverage percentages unchanged. The rerun-and-still-fail
path was exercised against a purpose-built flaky test that fails once
then passes: quiet failure, verbose rerun that genuinely re-executed,
exit 1 regardless. `make check` green.

README.md

@@ -387,7 +387,11 @@ them. We provide:
   plus the git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker
   image tag)
-- `script/test` — run the test suite (race detector, coverage)
+- `script/test` — run the test suite (race detector, coverage). Caching
+  is waived for testing, exactly as it is for linting: `-count=1`
+  forces every invocation to execute, because the suite queries live
+  DNS and a cached pass queries nothing. Failures are rerun with `-v`
+  automatically, and the build fails even if that rerun passes.
 - `script/lint` — run golangci-lint, always inside Docker: it builds
   `Dockerfile.lint`, which COPYs the repo into the digest-pinned
   `golangci-lint` image and lints as a build step, so a successful