Go tests run with -race and -cover under Go's own timeout (closes #88)

backend/script/test runs go test -timeout 30s -race -cover and, if
that fails, runs it again with -v and fails. The root script/test drops
its one 30-second timeout around both halves: from a cold Go build
cache, compiling the tests with -race used it all up. Each half keeps
its own limit. The race detector needs a C compiler: the Dockerfile
builder stage gains gcc and musl-dev, and script/bootstrap installs gcc,
with the C library headers on apt and apk, when gcc is missing; make
build still sets CGO_ENABLED=0. New tests: the health check's answer, a
valid report's answer, a report file's exact lines, and the flush at the
10 MiB threshold. The handlers TestImport stub is gone.

Model: opus-5-5

TODO.md

@@ -23,6 +23,17 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-03: the Go tests run with the race detector and coverage (issue #88):
+  `backend/script/test` runs `go test -timeout 30s -race -cover ./...` and, if
+  that fails, runs it again with `-v` and fails. Go's `-timeout` bounds the
+  tests, not their compile; the root `script/test` no longer puts one 30-second
+  timeout around both halves, which a cold Go build cache could use up on
+  compiling alone. The race detector needs a C compiler: the builder stage of
+  `Dockerfile` has gcc and musl-dev, and `script/bootstrap` installs gcc, with
+  the C library headers on apt and apk, when gcc is missing; the binary is still
+  built with `CGO_ENABLED=0`. New tests cover the health check's answer, a valid
+  report's answer, a report file's exact contents, and the flush when the buffer
+  reaches 10 MiB; the handlers' `TestImport` stub is gone
 - 2026-10-03: each target check times out after 80% of the refresh interval
   (issue #78), 24 seconds at 30 seconds, where it was capped at 3 seconds. A
   round started early, after an interval change or when the recovery probe finds