probe: downloadable executables for machines without Docker

Each release attaches selfphoneng-probe-linux-x64 and -arm64 (Node's single executable
applications: esbuild bundle + postject into the official Node binary, checked against
nodejs.org's SHASUMS256.txt), the bundle as selfphoneng-probe.cjs (Node 22+) and SHA256SUMS.
Built in binary.Dockerfile with BuildKit's local output, so Gitea's runner can build it too.
deploy/probe/selfphoneng-probe.service runs it under systemd, sandboxed.

apps/probe/binary.Dockerfile

@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Builds the probe's downloadable files (build-binary.mjs) and hands them back, no image:
+#   docker build -f apps/probe/binary.Dockerfile --output type=local,dest=probe-dist .
+FROM node:24-trixie-slim AS build
+RUN apt-get update && apt-get install -y --no-install-recommends xz-utils \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+COPY . .
+RUN corepack enable && pnpm install --frozen-lockfile --filter @selfphoneng/probe \
+ && node apps/probe/build-binary.mjs
+
+FROM scratch
+COPY --from=build /src/apps/probe/dist /