feat: tgcalls CLI test tool with group SFU, video, and adaptation

Squashed buildout of the tgcalls testbench:

- CLI test tool with --mode p2p/reflector/group/group-churn,
  cross-version interop (--version, --version2), and quiet/summary output
- Linux toolchain + Docker multi-stage build, AWS Fargate mass test harness,
  local parallel mass test harness with signaling loss simulation
- SCTP writable gate, retransmission timer tuning, role-based handshake
- InstanceV2CompatImpl (PeerConnection backend with V2Impl signaling) and
  SignalingTranslator for v14.0.0 interop
- In-process Go/Pion SFU (ICE+DTLS+SRTP+SCTP per participant) with audio
  RTP forwarding, ActiveAudio/VideoSsrcs data channel broadcast, RTCP
  feedback path, and CGo c-archive integration
- GroupInstanceReferenceImpl (PeerConnection group-call) and mixed-impl
  group mode (--reference-participants), with SDP munging for simulcast
- H264 simulcast group video (FakeVideoTrackSource pattern generator,
  FakeVideoSink frame counting, --video flag, two-pass channel setup,
  reactive video setup from ActiveVideoSsrcs)
- Group churn stress mode (--mode group-churn, --churn-cycles)
- SFU stream-quality adaptation: BandwidthEstimator, LayerSelector
  state machine, RtxRingBuffer, simulcast SSRC rewrite
- Transport-cc feedback generation, NetworkSimulator (delay/jitter/loss/
  token-bucket bandwidth), --network-scenario step-down-up
- CLAUDE.md updates throughout

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1
+# Multi-stage build for tgcalls_cli Linux container
+# Build: docker build -t tgcalls-test .
+# Run:   docker run tgcalls-test --mode reflector --reflector 91.108.13.2:598 --duration 10
+
+# ============================================================
+# Stage 1: Build
+# ============================================================
+FROM ubuntu:24.04 AS builder
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc g++ cmake meson ninja-build nasm make \
+    autoconf automake libtool pkg-config python3 \
+    unzip curl ca-certificates patch \
+    zlib1g-dev libbz2-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+
+# Copy source tree
+COPY . .
+
+# Always download Bazel for the container's architecture (host copy may be wrong arch)
+RUN ARCH=$(uname -m) && \
+    if [ "$ARCH" = "x86_64" ]; then BAZEL_ARCH="x86_64"; \
+    elif [ "$ARCH" = "aarch64" ]; then BAZEL_ARCH="arm64"; \
+    else echo "Unsupported arch: $ARCH" && exit 1; fi && \
+    curl -fL "https://github.com/bazelbuild/bazel/releases/download/8.4.2/bazel-8.4.2-linux-${BAZEL_ARCH}" \
+      -o build-input/bazel-8.4.2-linux && \
+    chmod +x build-input/bazel-8.4.2-linux
+
+# Build with persistent Bazel cache
+RUN --mount=type=cache,target=/root/.cache/bazel \
+    ./build-input/bazel-8.4.2-linux build //tools/tgcalls_cli:tgcalls_cli \
+      --strategy=Genrule=standalone --spawn_strategy=standalone && \
+    cp bazel-bin/tools/tgcalls_cli/tgcalls_cli /tmp/tgcalls_cli
+
+# ============================================================
+# Stage 2: Runtime (minimal)
+# ============================================================
+FROM ubuntu:24.04
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /tmp/tgcalls_cli /usr/local/bin/tgcalls_cli
+
+ENTRYPOINT ["tgcalls_cli"]
+CMD ["--help"]