chore(ci): run tests under -race, add coverage ratchet, ignore .claude

Andrew Dunnrequested to merge
chore/ci-hardening into main

What

Three CI/build hardening changes. No production Go code touched.

Race detector. The test job now runs with CGO_ENABLED=1 go test -race. The global pipeline variable stays CGO_ENABLED: "0" so build and binary-release remain fully static. The test job overrides it via a job-level variables: block. A local make test-race target mirrors the CI command.

Coverage ratchet. After each test run the job extracts the repo-wide statement total from coverage.out using go tool cover (no new dependencies) and fails if the total drops below 65%. Measured current total: 66.2%; floor is floor(66.2) - 1 = 65 for one point of slack.

Gitignore. Added .claude/ (worker scratch / ephemeral worktrees) and coverage.out (transient CI artifact) so neither can be committed accidentally.

Validation

  • CGO_ENABLED=1 go test -race ./... -count=1 passes locally, race-clean, ~3s total.
  • go tool cover -func=coverage.out | tail -1 reports 66.2%.
  • make check unchanged and green (CGO=0 path unaffected).
  • git check-ignore .claude/x coverage.out confirms both ignored.

Files changed

  • .gitlab-ci.yml -- test job: add variables: CGO_ENABLED: "1", replace bare go test with race + coverage + ratchet inline shell.
  • Makefile -- add test-race phony target; update .PHONY line.
  • .gitignore -- append .claude/ and coverage.out.

Merge request reports