fix: script/test conditional-verbose-rerun with -cover (closes #59)

Run the suite without -v first so a passing build shows only per-package
summaries; on failure rerun with -v for full diagnostics and exit
non-zero, matching the conditional-verbose-rerun pattern in
REPO_POLICIES.md. Add -cover to the first run per the policy's Go
example; keep -race (added in #55) and the existing nix-shell CGO
fallback for hosts without pkg-config/vips.

model: claude-opus-4-8

script/test

@@ -17,7 +17,11 @@ run_with_cgo_deps() {
 main() {
     cd "$ROOT"
     echo "Running tests..."
-    run_with_cgo_deps "CGO_ENABLED=1 go test -timeout 30s -race -v ./..."
+    # Run without -v first for clean output on success; on failure rerun
+    # with -v for full diagnostics, then exit non-zero (REPO_POLICIES.md
+    # conditional-verbose-rerun pattern). The first run already proved the
+    # tests broken, so the build fails even if the rerun happens to pass.
+    run_with_cgo_deps "CGO_ENABLED=1 go test -timeout 30s -race -cover ./... || { echo '--- Rerunning with -v for details ---'; CGO_ENABLED=1 go test -timeout 30s -race -v ./...; exit 1; }"
 }
 
 main "$@"