Make script/test fail on flaky failures and enable -race (closes #32)

script/test ended with a verbose rerun whose exit status became the
script's, so a test that failed once and passed on the retry gave a
green build. It now follows the REPO_POLICIES.md pattern: go vet, then
go test -count=1 -timeout 30s -race -cover; on failure a verbose rerun
for the details, then exit 1. -count=1 stays on both go test lines
because the Dockerfile keeps Go's build cache between builds.

Model: opus-5-5

TODO.md

@@ -18,6 +18,12 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-06: `script/test` runs the tests with the race detector, a 30-second
+  timeout per package and coverage, as `REPO_POLICIES.md` requires
+  (https://git.eeqj.de/sneak/secret/issues/32). When they fail, it reruns them
+  verbosely for the details and then fails anyway, so a test that fails once and
+  passes on the retry no longer gives a green build. `go vet` still runs first,
+  and every `go test` keeps `-count=1`.
 - 2026-10-06: `make test` in `script/cibuild` no longer compiles the standard
   library and every dependency from nothing on every build
   (https://git.eeqj.de/sneak/secret/issues/124). The `Dockerfile` runs it and

script/test

@@ -1,5 +1,6 @@
 #!/bin/sh
-# script/test: run the test suite (vet first, verbose rerun on failure).
+# script/test: run the test suite (vet first, then the tests with the race
+# detector; a verbose rerun on failure).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -10,8 +11,12 @@ main() {
     export CGO_ENABLED=1
     go vet ./...
     # -count=1: run every test, never take a result from Go's test cache,
-    # which the Dockerfile keeps between builds
-    go test -count=1 ./... || go test -count=1 -v ./...
+    # which the Dockerfile keeps between builds. The rerun only prints
+    # details: `exit 1` keeps the script failing even if a flaky test
+    # passes on the second attempt.
+    go test -count=1 -timeout 30s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -count=1 -timeout 30s -race -v ./...; exit 1; }
 }
 
 main "$@"