Run the tests under the race detector, in Docker (closes #23)

script/test is now the standard script: it builds only the test stage
of the Dockerfile, without the build cache, so tests no longer run on
the host. That stage calls go test -race -cover directly, with a
verbose rerun on failure, on the Debian-based golang image, which has
the C toolchain -race needs.

The test stage no longer copies from the lint stage, so script/test
builds the tests alone. A new final stage copies one file from each of
the two stages; that is what makes a plain docker build, and so
script/cibuild, run both. The README entry for script/test and TODO.md
say what now runs.

Model: opus-5-5

TODO.md

@@ -24,6 +24,10 @@ files it depends on: .golangci.yml, REPO_POLICIES.md, .editorconfig,
 
 # Completed Steps
 
+* 2026-10-06: the tests run under the race detector, in Docker:
+    `script/test` builds the `test` stage of the `Dockerfile`, which runs
+    `go test -race`, and a new final stage makes a plain `docker build`
+    run both the `lint` and `test` stages
 * 2026-10-06: the linter runs only in Docker: `script/lint` builds the
     `lint` stage of the `Dockerfile`, every `docker build` in `script/`
     runs without the build cache, and `script/bootstrap` no longer