Fix git ownership and -race in the canonical Go Dockerfile (closes #73)

The canonical Go `Dockerfile` example in `prompts/REPO_POLICIES.md` had two defects.

The test phase ran `go test -race` on the alpine Go image, which has no C compiler, so `-race` failed before any test ran. The test phase now uses the Debian Go image, pinned by digest like the others.

A build context sent as a tar stream keeps the sender's file owners, so git refused the checkout and the version step failed the build. The builder stage now runs `git config --system --add safe.directory /src`; the policy and both checklists say why in the same words.

The builder's `apk add --no-cache git` line is unchanged: whether it must be pinned is the open owner question on #72.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -67,10 +67,14 @@ with your task.
       argument when one is given, otherwise from `git describe --tags --always`.
       That gives the tag on a tagged commit; on a later commit, the tag, the
       number of commits since it and the short commit (`v1.2.3-4-gabc1234`); and
-      the short commit when no tag is reachable. `ARG VERSION` has no default,
-      and the build fails if the context carries `.git` and the version still
-      comes out empty, `dev` or `unknown`. A plain `docker build .` with no
-      build arguments must succeed; a Dockerfile that refuses an empty build
+      the short commit when no tag is reachable. The stage that compiles also
+      marks its working directory safe for git
+      (`git config --system --add safe.directory /src`): a context sent as a tar
+      stream keeps the sender's file owners, and git refuses a checkout owned by
+      another user, so the version would come out empty. `ARG VERSION` has no
+      default, and the build fails if the context carries `.git` and the version
+      still comes out empty, `dev` or `unknown`. A plain `docker build .` with
+      no build arguments must succeed; a Dockerfile that refuses an empty build
       argument drops that refusal and keeps the argument. `script/docker` and
       `script/cibuild` pass the version they compute on the host; it takes
       precedence. A tag-derived version additionally needs `fetch-depth: 0` on