ci: add race detector job

.github/workflows/tests.yml

@@ -27,6 +27,17 @@ jobs:
         with:
           name: coverage-report
           path: coverage.html
+  race-tests:
+    name: Race Detector
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.24"
+      - name: Run unit tests with the race detector
+        run: go test -race -count=1 ./pkg/...
   integration-tests:
     name: Integration Tests
     runs-on: ubuntu-latest

audit/pkg/_CROSS-CUTTING.audit.md

@@ -105,10 +105,10 @@ that the race detector only reports races that **actually execute**, so X1 and X
 have to be fixed together: a race detector pointed at packages with no tests
 finds nothing.
 
-**Status (2026-09-30) — partially resolved.** `make test-race` now exists
+**Status (2026-09-30) — resolved for the packages with tests.** `make test-race` now exists
 (`go test -race -count=1 ./pkg/...`), `test-unit` covers `./pkg/...`, and `test`
-depends on both. The CI workflow (`.github/workflows/tests.yml`) still has no
+depends on both. The CI workflow (`.github/workflows/tests.yml`) now has a `race-tests`
-race job, so nothing enforces it yet. The first full run was not clean:
+job running the same command. The first full run was not clean:
 
 | Package | Race | Kind |
 |---|---|---|