migrate stage build to native elc; chat restores from localStorage on return

Build pipeline
- build-stage.sh replaces the old in-Dockerfile bootstrap.py path. Host
  pre-compiles src/*.el into dist/main.c via the canonical native elc at
  foundation/el/dist/platform/elc and applies the stub-decl sed before
  docker buildx runs.
- Dockerfile.stage drops bootstrap.py + python3 from the builder stage
  and just runs cc on the host-supplied dist/main.c.
- Pre-rendered HTML shells under /srv/landing/ are now chowned to the
  landing user so the El page-builder's fs_write at startup can rewrite
  them — without that, post-COPY edits never reach the served HTML and
  the served page stays as the stale build-time fallback.

Chat restore
- session.verified + session.verifiedAt persist through localStorage so
  a return visit within 24h skips the Turnstile gate and lands directly
  in the restored conversation.
- restoreOrGreet() is the single source of truth for what shows up in
  the message pane after the gate clears: replays prior messages with
  skipSave, else drops the canned hello once and remembers it.
- applyVerifiedDom() hides the gate / reveals the chat row, called both
  from the verified-on-load path (DOMContentLoaded if loading, else
  immediate) and from the Turnstile callback.
- neuronDemoReset clears verified + verifiedAt so the gate returns next
  open.

Extracted JS assets (src/assets/js/*.js + manifest.json) and the
extract-js.py helper land here too — they match what the new build-stage
flow produces and removes the inline <script> blobs from the served HTML.

build-stage.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+#
+# build-stage.sh — Build the Stage marketing image (neuron-web + soul-demo).
+#
+# Pipeline:
+#   1. Stage the foundation El runtime into ./runtime/.
+#   2. Concatenate src/*.el into dist/main-combined.el (component-first,
+#      main.el last; matches the historical order from build-local.sh).
+#   3. Compile dist/main-combined.el → dist/main.c using the canonical
+#      native elc at foundation/el/dist/platform/elc.
+#   4. Inject the host-side stub forward declarations into dist/main.c
+#      (sed header rewrite, same set as the prior in-Dockerfile sed).
+#   5. docker buildx build --platform linux/amd64 -f Dockerfile.stage.
+#
+# bootstrap.py is no longer in the build path. The container image now
+# expects dist/main.c to be a finished C source — it just runs cc on it.
+#
+# Inline-JS extraction is gated by EXTRACT_JS=1 just like build-local.sh
+# was. Production deploys should always extract.
+#
+# Usage:
+#   ./build-stage.sh <tag>           — build marketing:<tag>
+#   EXTRACT_JS=1 ./build-stage.sh X  — also extract inline JS to assets
+
+set -euo pipefail
+cd "$(dirname "$0")"
+
+TAG="${1:-dev}"
+
+LANDING_DIR=$(pwd)
+EL_HOME="${EL_HOME:-${LANDING_DIR}/../../foundation/el}"
+ELC="${EL_HOME}/dist/platform/elc"
+RUNTIME_SRC="${EL_HOME}/el-compiler/runtime"
+
+if [ ! -x "${ELC}" ]; then
+    echo "elc not found at ${ELC}" >&2
+    exit 1
+fi
+
+echo "==> Staging El runtime from ${RUNTIME_SRC}"
+mkdir -p runtime dist
+cp "${RUNTIME_SRC}/el_runtime.c" runtime/
+cp "${RUNTIME_SRC}/el_runtime.h" runtime/
+
+# Optional inline-JS extraction. Off by default for fast dev iteration; the
+# script is idempotent so flipping the flag on a prior tree just reuses
+# previously-extracted assets.
+if [[ "${EXTRACT_JS:-0}" == "1" ]]; then
+    echo "==> Extracting inline JS → src/assets/js/"
+    if [ ! -x "node_modules/.bin/terser" ] || [ ! -x "node_modules/.bin/javascript-obfuscator" ]; then
+        echo "    installing terser + javascript-obfuscator (no-save)..."
+        npm install --no-save --silent terser javascript-obfuscator
+    fi
+    python3 scripts/extract-js.py
+fi
+
+echo "==> Combining El sources → dist/main-combined.el"
+COMPONENTS=(nav hero pillars how_it_works inference efficiency comparison
+    environmental enterprise mission local_first pricing marketplace viral
+    footer styles about founding_badge terms enterprise_terms checkout safety
+    gallery account)
+{
+    for f in "${COMPONENTS[@]}"; do
+        if [ -f "src/${f}.el" ]; then
+            grep -hv '^[[:space:]]*from\|^[[:space:]]*import' "src/${f}.el"
+            echo ""
+        fi
+    done
+    grep -v '^from\|^import' src/main.el
+} > dist/main-combined.el
+echo "    $(wc -l < dist/main-combined.el) lines"
+
+echo "==> Compiling dist/main-combined.el → dist/main.c via ${ELC}"
+"${ELC}" dist/main-combined.el > dist/main.c
+echo "    $(wc -l < dist/main.c) lines of C"
+
+echo "==> Injecting host-side stub forward declarations"
+# GNU vs BSD sed: -i with no arg works on GNU, breaks on macOS BSD sed
+# (BSD requires -i ''). Detect and branch.
+SED_INPLACE=(-i)
+if sed --version >/dev/null 2>&1; then
+    SED_INPLACE=(-i)
+else
+    SED_INPLACE=(-i '')
+fi
+sed "${SED_INPLACE[@]}" \
+  's|#include "el_runtime.h"|#include "el_runtime.h"\nel_val_t http_get_auth(el_val_t url, el_val_t tok);\nel_val_t http_post_auth(el_val_t url, el_val_t tok, el_val_t body);\nel_val_t cwd(void);\nel_val_t color_bold(el_val_t s);\nel_val_t unix_timestamp(void);\nel_val_t gcs_write(el_val_t bucket, el_val_t object_name, el_val_t content);\nel_val_t gcs_read(el_val_t bucket, el_val_t object_name);\nel_val_t supabase_insert(el_val_t project_url, el_val_t service_key, el_val_t table, el_val_t row_json);\nel_val_t supabase_get(el_val_t project_url, el_val_t service_key, el_val_t table_and_query);\nel_val_t supabase_auth_user(el_val_t project_url, el_val_t anon_key, el_val_t user_jwt);|' \
+  dist/main.c
+
+echo "==> Building Docker image marketing:${TAG} for linux/amd64"
+docker buildx build --platform linux/amd64 --load \
+    -f Dockerfile.stage \
+    -t "marketing:${TAG}" \
+    .
+
+echo "==> Done. marketing:${TAG} built."