ci: move go test into Dockerfile build stage

The runner runs jobs via act + DinD; `docker run -v "$PWD:/src"` from
inside the job container mounts the runner-job filesystem, not the
docker daemon's host fs, so the mount appears empty and `go test ./...`
fails with "directory prefix . does not contain main module".

Run tests in the same container that builds — same workspace, no mount.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -7,6 +7,10 @@ RUN go mod download
 COPY cmd/    ./cmd/
 COPY pkg/    ./pkg/
 
+# Tests run inside the build container — Gitea/act DinD makes mount-based
+# `docker run -v $PWD:/src` unreliable for native go test from the runner job.
+RUN go test -count=1 ./...
+
 ARG GIT_SHA=unknown
 RUN CGO_ENABLED=0 go build -trimpath \
         -ldflags="-s -w -X main.gitSHA=${GIT_SHA}" \