Run the tests under the race detector with make test-race (closes #18)

script/test-race runs go test -race in a digest-pinned Debian golang
image that has gcc, since the detector needs cgo and the build keeps it
off. The checkout is mounted read-only and the container is removed
afterwards. The tests run as the calling user, or as nobody when that is
root, so the tests that make a file unreadable still see the read fail.
It is not part of make check. The detector found no races.

Model: opus-5-5

script/bootstrap

@@ -7,8 +7,8 @@
 # installed: golangci-lint (script/lint) and prettier (script/fmt,
 # script/fmt-check) run via docker only, pinned by hash, so their only
 # prerequisite is a working docker — which is warned about, not
-# installed, because everything except linting and formatting works
-# without it.
+# installed, because everything except linting, formatting and
+# make test-race works without it.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -75,13 +75,14 @@ main() {
 
     # Linting and Markdown formatting run via docker only, so docker is
     # their prerequisite rather than something bootstrap installs. Warn,
-    # do not fail: everything except `make lint`, `make fmt` and
-    # `make fmt-check` — and, through them, `make check`, `make docker`
-    # and the pre-commit hook — works without it.
+    # do not fail: everything except `make lint`, `make fmt`,
+    # `make fmt-check` and `make test-race` — and, through them,
+    # `make check`, `make docker` and the pre-commit hook — works
+    # without it.
     if missing docker; then
         echo "bootstrap: WARNING: docker not found; make lint, make fmt," >&2
-        echo "bootstrap: make fmt-check, make check and make docker" >&2
-        echo "bootstrap: require it." >&2
+        echo "bootstrap: make fmt-check, make check, make docker and" >&2
+        echo "bootstrap: make test-race require it." >&2
     fi
 
     go mod download

script/test-race

@@ -0,0 +1,40 @@
+#!/bin/sh
+# script/test-race: run the test suite under the race detector. Not part
+# of script/check.
+#
+# The race detector needs cgo and a C compiler, which the host build
+# never uses, so the tests run in a golang image that has gcc. The
+# checkout is mounted read-only, so the docker daemon must be local. The
+# container starts with empty caches every time: each run downloads the
+# dependencies and compiles them with the detector, which needs the
+# network and takes minutes.
+#
+# The tests run as the calling user, never as root: several of them make
+# a file unreadable and expect reading it to fail, and root reads it
+# anyway. When the caller is root they run as nobody, and then the
+# checkout must be readable by other users. Neither user has a home
+# directory in the image, so HOME is /tmp, where Go puts its build cache.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# golang:1.25-trixie, 2026-10-04. Debian rather than the Alpine image the
+# Dockerfile builds with, because this one includes gcc.
+IMAGE="golang@sha256:2c4c60ef415fbfa5e90300722293bef36c5e63fae17570ce18f580af933dbd73"
+
+main() {
+    user="$(id -u):$(id -g)"
+    if [ "$(id -u)" -eq 0 ]; then
+        user=65534:65534
+    fi
+    docker run --rm \
+        --user "$user" \
+        --env HOME=/tmp \
+        --env CGO_ENABLED=1 \
+        --volume "$ROOT:/src:ro" \
+        --workdir /src \
+        "$IMAGE" \
+        go test -race -timeout 60s ./...
+}
+
+main "$@"