Run the tests under the race detector with make test-race (closes #18)

script/test-race runs go test -race in a digest-pinned Debian golang
image that has gcc, since the detector needs cgo and the build keeps it
off. The checkout is mounted read-only, the tests run as nobody so the
tests that make a file unreadable still see the read fail, and the
container is removed afterwards. It is not part of make check. The
detector found no races.

Model: opus-5-5

README.md

@@ -827,6 +827,15 @@ and may be invoked directly. The provided entrypoints are:
 -   `script/test` — run the test suite with a 30-second timeout and
     coverage enabled, rerunning verbosely on failure so the logs show
     which test failed.
+-   `script/test-race` — run the test suite under the race detector
+    with a 60-second timeout. The detector needs cgo and a C compiler,
+    which the build never uses, so the tests run in a digest-pinned
+    Debian `golang` image that has `gcc`, with the checkout mounted
+    read-only; the container is removed when it exits. They run as
+    `nobody`, because several tests make a file unreadable and root
+    reads it anyway. Not part of `script/check`. Every run starts with
+    empty caches, so it needs the network and takes minutes, and the
+    mount needs a local docker daemon.
 -   `script/lint` — run the linter. It builds `Dockerfile.lint`, which
     copies the repository into the digest-pinned
     `golangci/golangci-lint` image and runs
@@ -914,6 +923,9 @@ carries the compile recipe:
     pre-commit hook.
 -   `make test` — run the test suite (30-second timeout; reruns with
     `-v` on failure).
+-   `make test-race` — run the test suite under the race detector, in
+    Docker (see `script/test-race`); requires `docker`. Not part of
+    `make check`.
 -   `make lint` — run `golangci-lint` with the repo config, in Docker
     (see `script/lint`); requires `docker`.
 -   `make fmt` / `make fmt-check` — format Go sources / verify