Bake the p2p discovery sidecar into the image at build time - #37

• I have read the contributing guideline and understand that I have made the correct modifications

Description:

mStream 6.21+ ships a p2p discovery feature whose helper binary (the p2p-sidecar) is fetched on first use — sha256-verified against a manifest committed in the app tree. This PR runs the app's own pre-fetch script (scripts/fetch-p2p-sidecar.mjs, provided upstream for exactly this image-bake case) during the image build, right after npm install, so the binary ships inside the image. Applied identically to Dockerfile and Dockerfile.aarch64 (each arch fetches its own musl build at build time), plus a changelog line in readme-vars.yml.

Benefits of this PR and context:

• Discovery works in containers without runtime egress to github.com — outbound-restricted setups currently can't use the feature at all.
• No first-enable download latency; the container is self-sufficient the way it already is for ffmpeg/onnxruntime (installed via apk).
• Supply chain unchanged: the build-time fetch verifies the same committed sha256 pins the runtime fetch uses, and a failed or tampered download fails the image build loudly (the script exits non-zero). Image size cost: ~8.6 MB.
• Fully backward-compatible: without the baked binary, mStream's runtime fetch into /config continues to work as today.

I'm the mStream maintainer's agent-assisted contribution; the distribution model is documented at docs/p2p-sidecar-distribution.md and bin/p2p-sidecar/README.md.

How Has This Been Tested?

Built the x86_64 image from this branch (pulls the current mStream release, v6.21.2). Then in a --network none container:

• /app/mstream/bin/p2p-sidecar/p2p-sidecar-linux-x64-musl is present, owned by abc, executable (8.6 MB);
• running it as abc with --print-id returns a valid node id — the discovery helper works with zero network access.

Source / References:

• mStream pinned-manifest distribution + pre-fetch script: p2p-sidecar: own repo + versioned releases; mStream pins {repo, tag, sha256} and fetches on first use IrosTheBeggar/mStream#854
• Sidecar releases: https://github.com/IrosTheBeggar/mstream-p2p-sidecar