Run the tests under the race detector, in Docker (closes #23)

script/test is now the standard script: it builds only the test stage
of the Dockerfile, without the build cache, so tests no longer run on
the host. That stage calls go test -race -cover directly, with a
verbose rerun on failure, on the Debian-based golang image, which has
the C toolchain -race needs.

The test stage no longer copies from the lint stage, so script/test
builds the tests alone. A new final stage copies one file from each of
the two stages; that is what makes a plain docker build, and so
script/cibuild, run both. The README entry for script/test and TODO.md
say what now runs.

Model: opus-5-5

Dockerfile

@@ -9,13 +9,20 @@ RUN make fmt-check
 # Called directly: make lint is itself a docker build of this stage.
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Test stage: run full test suite
-# golang 1.22.12 (2025-02-04)
+# Test stage: run full test suite under the race detector
+# golang 1.22.12 (Debian-based; -race needs its C toolchain), 2025-02-04
 FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02 AS test
-# Depend on lint stage so both stages always run
-COPY --from=lint /src/go.sum /dev/null
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN make test
+# Called directly: make test is itself a docker build of this stage.
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
+
+# Final stage: the copies make a plain docker build run both stages above.
+# golang 1.22.12 (2025-02-04)
+FROM golang@sha256:1cf6c45ba39db9fd6db16922041d074a63c935556a05c5ccb62d181034df7f02
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null