ci: cover wholeprogram and CLI with the race detector

[picatz]

Summary

• Add a separate Go 1.27 race job for ./internal/wholeprogram and ./cmd/taint.
• Run both packages with -race -count=1 -p 1, preserving in-process concurrency while limiting package-level overlap.
• Keep the existing dual-version build/test and root/callgraph race jobs unchanged. Reuse the pinned actions and read-only permissions, with a 20-minute job limit.

Validation

• YAML parsing and structural checks passed: existing jobs, triggers and permissions are unchanged.
• Independent workflow review found no blocking issues.
• All eight exact-head hosted checks passed: https://github.com/picatz/taint/actions/runs/37820807926 .
• The new race job completed in 4m44s (test step: 4m31s): wholeprogram 48.866s and CLI 174.649s, all 46 top-level tests passed. No sharding or test filtering was needed. This is one hosted measurement, not a promised runtime.
• Logs confirm Go 1.27.1, the uncached race command and checkout of merge commit 14b4471, whose tree matches the reviewed candidate exactly.
• Each package retains Go's default 10-minute test-binary timeout within the 20-minute overall job budget.
• Post-merge verification: all eight checks passed on main at 41bed24: https://github.com/picatz/taint/actions/runs/37821887130 . The merged tree matches the reviewed candidate; the new race test step again took 4m31s with all 46 top-level tests passing (wholeprogram 48.950s; CLI 173.508s).

Base: e58576a.
Candidate: 8ce8cff.
Candidate tree: 3a1e260952c1e534d1dd64bc7f642762dd9b57c0.