Run the tests under the race detector with make test-race (closes #18)

script/test-race runs go test -race in a digest-pinned Debian golang
image that has gcc, since the detector needs cgo and the build keeps it
off. The checkout is mounted read-only and the container is removed
afterwards. The tests run as the calling user, or as nobody when that is
root, so the tests that make a file unreadable still see the read fail.
It is not part of make check. The detector found no races.

Model: opus-5-5

TODO.md

@@ -28,6 +28,10 @@
 
 # Completed Steps
 
+- `make test-race` runs the test suite under the race detector in a cgo-enabled
+  container, outside `make check` (2026-10-04,
+  https://git.eeqj.de/sneak/sfdupes/issues/18)
+
 - a bare `docker build .` fails with a message naming `script/cibuild` and
   `script/docker` instead of serving the gates from cache (2026-10-04,
   https://git.eeqj.de/sneak/sfdupes/issues/39)
@@ -497,5 +501,6 @@ Accepted divergences (no action):
 
 - flat single-package layout with `.go` files in the repo root — fine for a
   small single-binary tool per the Go styleguide; the tracker audit agrees
-- `go test` runs without `-race` — the repo mandates `CGO_ENABLED=0` (pure-Go
-  builds) and the race detector requires cgo
+- `make test` runs without `-race` — the repo mandates `CGO_ENABLED=0` (pure-Go
+  builds) and the race detector requires cgo, so the detector runs in a separate
+  cgo-enabled container, `make test-race`, which is not part of `make check`