probe: downloadable executables for machines without Docker

Each release attaches selfphoneng-probe-linux-x64 and -arm64 (Node's single executable
applications: esbuild bundle + postject into the official Node binary, checked against
nodejs.org's SHASUMS256.txt), the bundle as selfphoneng-probe.cjs (Node 22+) and SHA256SUMS.
Built in binary.Dockerfile with BuildKit's local output, so Gitea's runner can build it too.
deploy/probe/selfphoneng-probe.service runs it under systemd, sandboxed.

deploy/probe/selfphoneng-probe.service

@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# The network test probe (08 §2.6) as a service, without Docker. With the downloaded executable at
+# /usr/local/bin/selfphoneng-probe:
+#   sudo cp selfphoneng-probe.service /etc/systemd/system/
+#   sudo systemctl enable --now selfphoneng-probe
+#   sudo ufw allow 8080/tcp
+[Unit]
+Description=SelfPhoneNG network test probe
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/local/bin/selfphoneng-probe
+Environment=PORT=8080
+# Behind your own HTTPS reverse proxy that sets X-Forwarded-For: PORT to a local one, and
+#Environment=TRUST_PROXY=true
+Restart=always
+RestartSec=5
+# It needs nothing but the network: no files, no privileges.
+DynamicUser=yes
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryMax=200M
+
+[Install]
+WantedBy=multi-user.target