Make the tests fast under the race detector (closes #120)

Deriving keys from passphrases with scrypt, slow on purpose, took most
of the test time under -race. secret.ScryptWorkFactor, when not zero,
replaces age's work factor when a passphrase encrypts; the tests of
internal/secret, internal/vault and internal/cli set it to 1 in
TestMain, and the program never sets it.

TestRemovalAsksWithoutHoldingLock and TestFailedCommandReleasesLock
time the in-memory lock all tests share, so they no longer run in
parallel. TestConcurrentAddsKeepEveryVersion and
TestGetCommandOutputsToStdout time nothing and now do.

The script/cibuild comment no longer says tests are skipped without
its memlock ulimit.

Model: opus-5-5

internal/cli/lock_test.go

@@ -94,9 +94,9 @@ func numbered(prefix string, count int) []string {
 // lock, adds of a new secret all find it absent and replace each other, and
 // forced adds read the same highest version number and overwrite each
 // other's version. With it they behave as if run one after another.
-//
-//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
+	t.Parallel()
+
 	mnemonic := testMnemonicBuffer(t)
 
 	const adds = 8
@@ -110,6 +110,8 @@ func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
 		{"real", afero.NewOsFs(), t.TempDir()},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default", mnemonic, nil)
 			require.NoError(t, err)
 
@@ -235,9 +237,9 @@ func TestEncryptPipedIntoAdd(t *testing.T) {
 
 // TestFailedCommandReleasesLock checks that a command failing after it
 // took the state directory lock leaves the lock free for the next command.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestFailedCommandReleasesLock(t *testing.T) {
-	t.Parallel()
-
 	fs := afero.NewMemMapFs()
 	cli := NewCLIInstanceWithStateDir(fs, testStateDir)