Add Docker sidecar deployment for FIPS

Tailscale-style sidecar pattern: a FIPS container provides mesh
networking, and a companion app container shares its network namespace
via network_mode: service:fips.

Security model:
- iptables enforces strict isolation — the app container can only
  communicate over the FIPS mesh (fd::/8 via fips0)
- No IPv4 access: eth0 restricted to FIPS UDP transport (port 2121)
- No IPv6 on eth0: ip6tables blocks all eth0 IPv6 traffic
- Only fips0 and loopback are reachable from the app container

The sidecar accepts peer configuration via environment variables
(FIPS_NSEC, FIPS_PEER_NPUB, FIPS_PEER_ADDR), so it can be pointed
at any FIPS node without config file generation.

Files:
- testing/sidecar/: Dockerfile, Dockerfile.app, docker-compose.yml,
  entrypoint.sh, .env, resolv.conf, scripts/build.sh
- testing/sidecar/README.md: security model, quick-start, architecture,
  DNS resolution, troubleshooting, production considerations
- testing/sidecar/scripts/test-sidecar.sh: 3-node chain integration
  test verifying link establishment, multi-hop connectivity, and
  network isolation on each app container
- .github/workflows/ci.yml: sidecar integration test matrix entry

.github/workflows/ci.yml

@@ -178,6 +178,9 @@ jobs:
           - suite: mixed-technology
             type: chaos
             scenario: mixed-technology
+          # ── Sidecar deployment ──────────────────────────────────────────
+          - suite: sidecar
+            type: sidecar
 
     steps:
       - uses: actions/checkout@v4
@@ -255,4 +258,25 @@ jobs:
         with:
           name: sim-results-${{ matrix.scenario }}
           path: testing/chaos/sim-results/
-          retention-days: 7
+          retention-days: 7
+
+      # ── Sidecar deployment ──────────────────────────────────────────────
+      - name: Install binary (sidecar)
+        if: matrix.type == 'sidecar'
+        run: |
+          chmod +x _bin/fips _bin/fipsctl
+          cp _bin/fips    testing/sidecar/fips
+          cp _bin/fipsctl testing/sidecar/fipsctl
+
+      - name: Run sidecar integration test
+        if: matrix.type == 'sidecar'
+        run: bash testing/sidecar/scripts/test-sidecar.sh
+
+      - name: Collect logs on failure (sidecar)
+        if: matrix.type == 'sidecar' && failure()
+        run: |
+          for node in a b c; do
+            echo "--- sidecar-${node} logs ---"
+            docker logs "sidecar-${node}-fips-1" 2>&1 || true
+            echo ""
+          done