feat: add Linux arm64 glibc prebuilds

[pedrojhfs]

Summary

Linux arm64 hosts (Ampere/Neoverse cloud VMs, Graviton, Raspberry Pi 4/5 on a 64-bit OS) have no prebuild today, so every install there falls back to a cmake-js source build of libdatachannel. On small ARM VMs that means installing a C++ toolchain and compiling on every deploy.

This adds a linux-arm64-glibc prebuild, following the existing win32-arm64 and darwin-arm64 pattern:

• release.yml: new linux-arm64-glibc leg on ubuntu-24.04-arm, reusing build-containers/Dockerfile.debian (glibc 2.31); the matrix now carries os and arch instead of hardcoding x64.
• scripts/prebuild-integrity.js: accept ELF aarch64 (machine 183) linked against glibc. arm64 musl stays unsupported and keeps the source-build fallback.
• scripts/check-prebuilds.js: require the new asset before release upload.
• published-install.yml: verify the published package on an arm64 runner.
• ci.yml: add an ubuntu-24.04-arm / Node 24 leg to the build matrix, so the arm64 build is exercised before release day (same as windows-11-arm).
• README.md: list the target.

Depends on #40: the Debian bullseye image no longer builds without it. This branch includes that commit and will be rebased once #40 is merged.

Verification

• npm run check
• npm run native:check - in the fork CI matrix, including ubuntu-24.04-arm
• npm run build - in the fork CI matrix, including ubuntu-24.04-arm
• npm test - locally for test/prebuild-integrity.test.js (11/11), full suite in the fork CI matrix including ubuntu-24.04-arm
• npm run api:check - in the fork CI matrix
• npm run types:check - in the fork CI matrix
• npm run e2e:chrome - not applicable; no browser interop path change
• npm run wpt:selection:check - not applicable; no WPT change
• npm run wpt:smoke - not applicable
• npm run wpt:smoke:check - not applicable
• npm run wpt:test / npm run wpt:check:strict - not applicable; no WebRTC behavior change

Fork CI run: https://github.com/pedrojhfs/webrtc/actions/runs/37535904691. Every job passes except windows-11-arm / Node 24, which also fails on an unchanged copy of main (https://github.com/pedrojhfs/webrtc/actions/runs/37539759758) in the same way: all subtests pass, but test/basic.test.js and test/nonstandard.test.js exit non-zero. That failure predates this change and is not addressed here.

Additionally:

• ran the release prebuild command from release.yml inside Dockerfile.debian on linux/arm64; it produced webrtc-node-v0.2.1-napi-v8-linux-arm64-glibc.tar.gz plus its .sha256, and the archive passes validateArchiveFile for linux/arm64/glibc
• installed that archive on a real Ampere Neoverse-N1 VM (Ubuntu 22.04, glibc 2.35, Node 22.23): a local RTCPeerConnection pair opened a data channel and exchanged a message; OpenSSL is linked statically (ldd shows only libc)
• the release.yml dispatch itself was not run on the fork (workflow dispatch is not available there before a default-branch event), so the first real run of the new release leg will be the next release; the CI leg above runs the same native build on the same runner image

WPT impact

None. wpt-manifest.json and docs/divergences.md are unchanged.

Browser interoperability

No Chrome E2E behavior or coverage changes.

Notes

• Workflow/release impact: new GitHub-hosted runner label ubuntu-24.04-arm in release.yml, published-install.yml and ci.yml. No new permissions or secrets.
• Publication impact: publish now requires the linux-arm64-glibc asset, so a broken arm64 build blocks the release, the same as the other targets.
• arm64 prebuilds are usable only from the next release on: the validator shipped in 0.2.1 rejects linux-arm64, so uploading an asset to existing releases would not help. A manual published-install dispatch against @latest (0.2.1) will fail the arm64 leg until such a release exists; the workflow_run path tests the newly released version and is unaffected.
• No libdatachannel pin, WPT pin, native lifetime, or callback-threading impact.

🤖 Generated with Claude Code