CI hardening: enable -race, coverage, golangci-lint, and split unit/integration tests

[whywaita]

Problem

.github/workflows/test.yaml runs staticcheck + go vet + make test (go test -v ./...), but:

• No -race. starter/runner use goroutines and channels heavily; data-race detection is effectively required.
• No coverage measurement. No -coverprofile / codecov, so coverage regressions go unnoticed.
• staticcheck@latest is installed unpinned, hurting build reproducibility.
• golangci-lint is not used. Running it locally surfaces 22 issues today (14 errcheck, 8 staticcheck), e.g. unchecked tx.Rollback(), json.Encoder.Encode.

Additionally, all DB/web tests depend on ory/dockertest (real MySQL) with no build-tag separation, so make test always requires Docker and there is no fast unit-only path.

Suggested fix

• Add -race to the test invocation.
• Add coverage output and (optionally) codecov upload.
• Pin the staticcheck version; consider adopting golangci-lint with a committed .golangci.yml.
• Tag integration tests (//go:build integration) and split make test (unit) from make test-integration.