probe: downloadable executables for machines without Docker

Each release attaches selfphoneng-probe-linux-x64 and -arm64 (Node's single executable
applications: esbuild bundle + postject into the official Node binary, checked against
nodejs.org's SHASUMS256.txt), the bundle as selfphoneng-probe.cjs (Node 22+) and SHA256SUMS.
Built in binary.Dockerfile with BuildKit's local output, so Gitea's runner can build it too.
deploy/probe/selfphoneng-probe.service runs it under systemd, sandboxed.

docs/admin-guide/network.md

@@ -74,7 +74,31 @@ public address back in, or route it without going through the port forwards.
 - **Complete network test**: also SIP over TLS (if on), the browser phone's `/ws`, and a sample
   of the call audio ports (the server listens on them while the probe sends to them).
 
-To run a probe, on any machine outside your network (a small VPS is plenty):
+To run a probe, on any machine outside your network (a small VPS is plenty). It needs about
+50 MB of memory and one open TCP port (8080).
+
+**Without Docker:** each release has the probe as a single executable for Linux, with everything it
+needs inside (`selfphoneng-probe-linux-x64`, or `-arm64` for ARM machines), next to `SHA256SUMS`.
+With Node 22 or newer installed you can take the small `selfphoneng-probe.cjs` instead.
+
+```sh
+v=v0.0.3   # the release
+curl -fLO https://git.dou.bet/spng/selfphoneng/releases/download/$v/selfphoneng-probe-linux-x64
+curl -fLO https://git.dou.bet/spng/selfphoneng/releases/download/$v/SHA256SUMS
+sha256sum --check --ignore-missing SHA256SUMS
+sudo install -m 755 selfphoneng-probe-linux-x64 /usr/local/bin/selfphoneng-probe
+curl -fLO https://git.dou.bet/spng/selfphoneng/raw/tag/$v/deploy/probe/selfphoneng-probe.service
+sudo cp selfphoneng-probe.service /etc/systemd/system/
+sudo systemctl enable --now selfphoneng-probe
+sudo ufw allow 8080/tcp
+```
+
+(On GitHub, the downloads are at `https://github.com/iamdoubz/selfphoneng/releases/download/$v/…`.)
+To try it first without the service, run `./selfphoneng-probe-linux-x64` and open
+`http://<machine>:8080/healthz`. `PORT` changes the port; behind your own HTTPS reverse proxy
+that sets X-Forwarded-For, also set `TRUST_PROXY=true`.
+
+**With Docker:**
 
 ```sh
 docker compose -f deploy/probe/compose.yml up -d

docs/spec/08-security-ops.md

@@ -107,6 +107,14 @@ how to fix it.
   `apps/probe` (no dependencies, its own image `selfphoneng-probe`, `deploy/probe/compose.yml`),
   run outside the network; `network.probeUrl` points at it. A server can't test its own ports:
   hairpin NAT is missing or skips the port forwards, and browsers refuse port 5060.
+  - Without Docker (owner, 2026-10-21): each release also attaches `selfphoneng-probe-linux-x64`
+    and `-arm64` (Node's single executable applications: esbuild bundles the probe into one CJS
+    file, postject injects it into that Node's official binary, checked against nodejs.org's
+    SHASUMS256.txt), the bundle itself (`selfphoneng-probe.cjs`, Node 22+) and `SHA256SUMS`.
+    `apps/probe/build-binary.mjs`, run in `binary.Dockerfile` with BuildKit's local output (so it
+    works on Gitea's runner, where the job's checkout can't be bind-mounted).
+    `deploy/probe/selfphoneng-probe.service` runs it under systemd with `DynamicUser` and a
+    read-only system. About 45 MB of memory.
   - `POST /v1/check {host, tests}`: the probe tests **only the address the request came from** (the
     last X-Forwarded-For entry with `TRUST_PROXY=true`), so it can't be aimed at anyone else; 20
     tests at most, 10 checks per address per 10 minutes, 4 s per test.