Run the tests with cgo off and without the race detector (closes #538)

sneak ruled the race detector out
(#538 (comment)), and on
Linux it was the only reason the tests needed cgo. The test phase and the
browser test binary now build with CGO_ENABLED=0 and without -race, so no
test binary compiles mattn's C SQLite. The test phase keeps the builder
stage's Debian Go image. Its comments, the README and the code comments that
said the suite runs under -race now say what is true, and the README notes
the exception to the vendored REPO_POLICIES.md.

Model: opus-5-5

README.md

@@ -60,7 +60,7 @@ make assets     # Extract Alpine.js from 3p/ (build and dev run it)
 make fmt        # Format Go (gofmt + goimports) and Markdown (prettier, in Docker)
 make fmt-check  # Fail if gofmt or prettier would change anything (writes nothing)
 make lint       # Run golangci-lint and ESLint in Docker
-make test       # Run tests with race detection, in Docker
+make test       # Run tests with cgo off, in Docker
 make test-browser # Run the browser test in Docker (Dockerfile.browser)
 make check      # test + lint + fmt-check + css-check (CI gate)
 make build      # Build binary to bin/webhooker (version-stamped)
@@ -75,6 +75,11 @@ make css-check  # Fail if static/css/tailwind.css is stale (writes nothing)
 make clean      # Remove bin/
 ```
 
+The tests run with cgo off and so without Go's race detector, which needs cgo on
+Linux: an exception to the `-race` in the test phase of the vendored
+`REPO_POLICIES.md`, ruled by @sneak in
+https://git.eeqj.de/sneak/webhooker/issues/538#issuecomment-153273.
+
 ### Configuration
 
 All configuration is via environment variables. For local development, you can
@@ -3480,8 +3485,8 @@ fixed independently of the compiler's:
    `golangci-lint config verify` and `golangci-lint run`, both with
    `--network=none`, and depends on `js-lint` (it copies a file from it).
    `make lint` builds this stage alone.
-5. **Test phase** (`test`, `golang:1.26.1-bookworm`, whose C compiler `-race`
-   needs) — extracts Alpine.js, then runs `go test -race -cover` at most four
+5. **Test phase** (`test`, `golang:1.26.1-bookworm`, the builder stage's image)
+   — extracts Alpine.js, then runs `go test -cover` with cgo off, at most four
    packages and eight tests at a time, with a 90-second timeout per package. On
    a failure it runs only the failed tests again with `-v`, since verbose output
    from the whole suite would pass the 2 MiB at which the Docker build cuts off