migrate stage build to native elc; chat restores from localStorage on return

Build pipeline
- build-stage.sh replaces the old in-Dockerfile bootstrap.py path. Host
  pre-compiles src/*.el into dist/main.c via the canonical native elc at
  foundation/el/dist/platform/elc and applies the stub-decl sed before
  docker buildx runs.
- Dockerfile.stage drops bootstrap.py + python3 from the builder stage
  and just runs cc on the host-supplied dist/main.c.
- Pre-rendered HTML shells under /srv/landing/ are now chowned to the
  landing user so the El page-builder's fs_write at startup can rewrite
  them — without that, post-COPY edits never reach the served HTML and
  the served page stays as the stale build-time fallback.

Chat restore
- session.verified + session.verifiedAt persist through localStorage so
  a return visit within 24h skips the Turnstile gate and lands directly
  in the restored conversation.
- restoreOrGreet() is the single source of truth for what shows up in
  the message pane after the gate clears: replays prior messages with
  skipSave, else drops the canned hello once and remembers it.
- applyVerifiedDom() hides the gate / reveals the chat row, called both
  from the verified-on-load path (DOMContentLoaded if loading, else
  immediate) and from the Turnstile callback.
- neuronDemoReset clears verified + verifiedAt so the gate returns next
  open.

Extracted JS assets (src/assets/js/*.js + manifest.json) and the
extract-js.py helper land here too — they match what the new build-stage
flow produces and removes the inline <script> blobs from the served HTML.

Dockerfile.stage

@@ -4,8 +4,10 @@
 #   - neuron-web  on port 8080 (landing page server)
 #   - soul-demo   on port 7772 (demo chat, localhost only)
 #
-# Both binaries are compiled from C inside Docker for linux/amd64.
-# The engram snapshot is baked in so the soul has memory from first boot.
+# bootstrap.py is no longer in the build path. The host-side build-stage.sh
+# pre-compiles src/*.el → dist/main.c using the canonical native elc and
+# applies the stub forward-declaration sed before this Dockerfile runs.
+# The image just compiles the finished C source.
 
 # ── Stage 1: compile both binaries ────────────────────────────────────────────
 FROM debian:bookworm-slim AS builder
@@ -15,7 +17,6 @@ RUN apt-get update \
         build-essential \
         libcurl4-openssl-dev \
         libssl-dev \
-        python3 \
         ca-certificates \
  && rm -rf /var/lib/apt/lists/*
 
@@ -26,22 +27,13 @@ COPY runtime/el_runtime.c runtime/el_runtime.h ./
 
 # ── Build neuron-web ──────────────────────────────────────────────────────────
 #
-# Inline-JS extraction (scripts/extract-js.py) is expected to run BEFORE the
-# wrapper concatenates src/*.el into dist/main-combined.el. That side of the
-# pipeline lives in build-local.sh (gated by EXTRACT_JS=1) and the outer
-# orchestrator. By the time we reach this Dockerfile, main-combined.el
-# already references /assets/js/<hash>.js and the corresponding asset files
-# have been emitted under src/assets/js/. The COPY of src/assets at the
-# runtime stage below is what ships those files into the container.
+# main.c was generated on the host by build-stage.sh from src/*.el via the
+# native elc compiler. Stub forward-declarations were already injected on
+# the host side, so this stage is a straight cc invocation.
 COPY dist/web_stubs.c ./
-COPY dist/bootstrap.py ./
-COPY dist/main-combined.el ./
+COPY dist/main.c ./
 
-RUN python3 bootstrap.py main-combined.el > main.c && \
-    sed -i \
-      's|#include "el_runtime.h"|#include "el_runtime.h"\nel_val_t http_get_auth(el_val_t url, el_val_t tok);\nel_val_t http_post_auth(el_val_t url, el_val_t tok, el_val_t body);\nel_val_t cwd(void);\nel_val_t color_bold(el_val_t s);\nel_val_t unix_timestamp(void);\nel_val_t gcs_write(el_val_t bucket, el_val_t object_name, el_val_t content);\nel_val_t gcs_read(el_val_t bucket, el_val_t object_name);\nel_val_t supabase_insert(el_val_t project_url, el_val_t service_key, el_val_t table, el_val_t row_json);\nel_val_t supabase_get(el_val_t project_url, el_val_t service_key, el_val_t table_and_query);\nel_val_t supabase_auth_user(el_val_t project_url, el_val_t anon_key, el_val_t user_jwt);|' \
-      main.c && \
-    cc -O2 -rdynamic \
+RUN cc -O2 -rdynamic \
        -o neuron-web \
        main.c web_stubs.c el_runtime.c \
        -lcurl -lpthread -ldl -lm -lssl -lcrypto
@@ -79,7 +71,12 @@ COPY src/assets /srv/landing/assets
 COPY src/llms.txt /srv/landing/llms.txt
 # Pre-rendered HTML shells (about, terms, enterprise-terms, index) used as
 # fallback when the El page-builder hasn't been seeded yet at startup.
+# chown to the landing user so the El runtime's fs_write at startup can
+# rewrite them with the freshly-rendered page (extracted JS asset paths,
+# updated chat widget, etc.). Without this they stay as their COPY'd root-
+# owned shells and the served HTML never reflects post-COPY source edits.
 COPY src/about.html src/terms.html src/enterprise-terms.html src/index.html /srv/landing/
+RUN chown landing:landing /srv/landing/about.html /srv/landing/terms.html /srv/landing/enterprise-terms.html /srv/landing/index.html /srv/landing/llms.txt
 
 COPY dist/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh