[P3] Dockerfile: static non-root build; CI: run tests with -race

Priority: P3 (build / CI) · Effort: S

Dockerfile

Build with CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" and drop gcc musl-dev and -a -installsuffix cgo. go-ethereum falls back to pure-Go secp256k1, and this tool doesn't sign anything.
Pin the runtime image (alpine:3.x or gcr.io/distroless/static:nonroot) instead of alpine:latest, and run as non-root.
✅ Smaller image, faster builds, safer runtime.
⚠️ Smoke-test that the binary still starts (ev-metrics --help).

Run tests with -race (Makefile test target or .github/workflows/test.yml). The verifier is heavily concurrent.

Additions found while reviewing the open PRs:

Pin golangci-lint. lint.yml installs it from golangci-lint/master/install.sh (latest), so lint results change over time. fix(deps): upgrade ev-node to v1.0.0 and fix broken metrics #33 shows a red Lint check, but golangci-lint v2.15.0 reports 0 issues on that branch today. Pin a version (for example with golangci/golangci-lint-action and an explicit version:).
Bump actions off Node 20: actions/checkout@v4 → v5, actions/setup-go@v5 → v6. GitHub removed Node 20 from runners on 2026-09-16.
Add govulncheck to CI (see [P1] Bump vulnerable deps: go-ethereum ≥1.17.0, grpc ≥1.83.1, x/net ≥0.60.0 (supersedes #30) #54).

Status after #56 and #58:

The Dockerfile builder is now golang:1.26-alpine (Go 1.26 is required by x/net v0.60.0). It still uses CGO_ENABLED=1, -a -installsuffix cgo, and an unpinned alpine:latest running as root.
Lint now uses golangci/golangci-lint-action@v8, but with version: latest, so it is still unpinned.
actions/checkout@v4 and actions/setup-go@v5 are still on Node 20.
No -race in make test and no govulncheck step yet. govulncheck currently reports only GO-2026-5932 (x/crypto, no fix yet), so a CI step needs an allowlist for it or should be informational until upstream fixes it.

Status after #57–#59: nothing in this issue has changed on main yet. Still open:

Dockerfile: CGO_ENABLED=1, -a -installsuffix cgo, gcc musl-dev, unpinned alpine:latest, runs as root. The builder is golang:1.26-alpine (Go 1.26 is required since P1: verifier scalability, DA cache, client reuse, log format, security bumps #58).
CI: golangci-lint-action uses version: latest; checkout@v4 and setup-go@v5 are on Node 20; make test has no -race; no govulncheck step (it currently reports only GO-2026-5932 in x/crypto, no fix yet, so it needs an exception or should be informational).
The Dependabot PR chore(deps): bump the go_modules group across 1 directory with 2 updates #60 (grpc 1.83.2, edwards25519 1.1.1) is a normal patch bump and can be merged independently.

build(ci): static non-root Docker image, pinned lint, race tests, gov…

Merge subagent: P3 #52 Docker and CI hardening

ci(govulncheck): scan with the latest Go release instead of the go.mo…