Run the tests with cgo off and without the race detector (closes #538)

sneak ruled the race detector out
(#538 (comment)), and on
Linux it was the only reason the tests needed cgo. The test phase and the
browser test binary now build with CGO_ENABLED=0 and without -race, so no
test binary compiles mattn's C SQLite. The test phase keeps the builder
stage's Debian Go image. Its comments, the README and the code comments that
said the suite runs under -race now say what is true, and the README notes
the exception to the vendored REPO_POLICIES.md.

Model: opus-5-5

Dockerfile

@@ -118,8 +118,9 @@ COPY --from=js-lint /src/yarn.lock /dev/null
 # depends on it.
 #
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17: the builder stage's
-# image, which that stage needs for its git and make. This stage uses only
-# its Go.
+# image, which that stage needs for its git and make. This stage runs its
+# steps under the image's bash, and the tests in internal/versionscript use
+# its git, make and sh, and skip when they are missing.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS test
 
 WORKDIR /src