fix(tests): isolate SCIM bad-id test from shared postgres state

.github/workflows/release.yml

@@ -139,8 +139,8 @@ jobs:
         shell: bash
         run: |
           cd dist
-          shasum -a 256 * 2>/dev/null || sha256sum *
-          shasum -a 256 * > checksums.sha256
+          shasum -a 256 -- * 2>/dev/null || sha256sum -- *
+          shasum -a 256 -- * > checksums.sha256
       - name: Create release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2
         with:

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the LastState Trace backend.
 
 ## [Unreleased]
 
+### Fixed
+- **SCIM test isolation** - `TestSCIMBadID` used a fixed admin email, so the
+  `Race` step failed with a duplicate-key error against the same Postgres
+  service used by the earlier `Test` step. It now uses a unique email per
+  run like the other API tests.
+
 ## [0.9.0] - 2026-09-20
 
 ### Security

internal/api/scim_test.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
 )
@@ -33,7 +34,10 @@ func TestSCIMRequiresSession(t *testing.T) {
 func TestSCIMBadID(t *testing.T) {
 	s, st, _ := testAPI(t)
 	h := s.Handler()
-	secret := testUISession(t, st, "scim-admin@t.local", "admin")
+	// Unique email per run: CI runs `go test ./...` then `go test -race`
+	// against the same postgres service, so a fixed email collides on the
+	// second run with `duplicate key ... users_email_key`.
+	secret := testUISession(t, st, "scim-"+time.Now().Format("150405.000000")+"@t.local", "admin")
 	rr := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodGet, "/scim/v2/Users/not-a-uuid", nil)
 	req.Header.Set("Authorization", "Bearer "+secret)