Make script/test fail on flaky failures and enable -race (closes #32)

script/test ended with a verbose rerun whose exit status became the
script's, so a test that failed once and passed on the retry gave a
green build. It now follows the REPO_POLICIES.md pattern: go vet, then
go test -count=1 -timeout 30s -race -cover; on failure a verbose rerun
for the details, then exit 1. -count=1 stays on both go test lines
because the Dockerfile keeps Go's build cache between builds.

The tests that gave the secret binary a minute, and the PGP unlocker
test's 30-second timer, now use 10 seconds, so a hang fails with the
test's own message before the package's 30-second timeout. The README
describes the new run.

Model: opus-5-5

script/test

@@ -1,5 +1,6 @@
 #!/bin/sh
-# script/test: run the test suite (vet first, verbose rerun on failure).
+# script/test: run the test suite (vet first, then the tests with the race
+# detector; a verbose rerun on failure).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -10,8 +11,12 @@ main() {
     export CGO_ENABLED=1
     go vet ./...
     # -count=1: run every test, never take a result from Go's test cache,
-    # which the Dockerfile keeps between builds
-    go test -count=1 ./... || go test -count=1 -v ./...
+    # which the Dockerfile keeps between builds. The rerun only prints
+    # details: `exit 1` keeps the script failing even if a flaky test
+    # passes on the second attempt.
+    go test -count=1 -timeout 30s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -count=1 -timeout 30s -race -v ./...; exit 1; }
 }
 
 main "$@"