Replace k3s with direct soul-demo watchdog in Cloud Run container

Cloud Run gen2 doesn't provide eth0 with a unicast IP, causing k3s flannel
to crash on every container start. k3s was also wrong architecture for
Cloud Run (HPA inside a container, k3s overhead for one process).

Changes:
- entrypoint.sh: replace k3s server with a bash watchdog loop that starts
  soul-demo directly and restarts it on crash (3s backoff)
- Dockerfile.stage: remove k3s binary, soul-demo-image.tar, k3s manifests
  and their associated dirs/envvars; keep soul-demo binary only
- stage.yaml: remove 'Download k3s binary' step; rename and simplify
  soul-demo build step to compile binary only (no OCI image/tar)
- dev.yaml: update soul-demo placeholder step (binary not tar)
- manifest.el: document HAVE_CURL requirement since manifest.el has no
  c_flags/link_flags directive support

.gitea/workflows/dev.yaml

@@ -172,11 +172,12 @@ jobs:
       - name: Touch HTML placeholder files
         run: touch src/index.html src/about.html src/terms.html src/enterprise-terms.html
 
-      - name: Create soul-demo-image.tar placeholder
-        # Dockerfile.stage COPYs this file (used by k3s at runtime).
-        # We only need the COPY to succeed here; real tar is built by
-        # build-stage.sh in the deploy pipeline.
-        run: touch dist/soul-demo-image.tar
+      - name: Create soul-demo placeholder
+        # Dockerfile.stage COPYs dist/soul-demo. We only need the binary to exist
+        # for the Docker build to succeed; the real binary is compiled in stage CI.
+        run: |
+          touch dist/soul-demo
+          chmod +x dist/soul-demo
 
       - name: Build Docker image (local only — no push)
         run: |

.gitea/workflows/stage.yaml

@@ -173,15 +173,15 @@ jobs:
 
       # ── Docker build + push ───────────────────────────────────────────────
 
-      - name: Build soul-demo image tar
-        # Dockerfile.stage COPYs dist/soul-demo-image.tar so k3s can import
-        # soul-demo:local at runtime. We compile soul-demo from source on the
-        # host runner (ci-base has gcc), build a minimal OCI image, and save it.
+      - name: Build soul-demo binary
+        # Compile soul-demo directly on the host runner (ci-base has gcc).
+        # Cloud Run runs soul-demo as a direct subprocess with a watchdog loop —
+        # no k3s, no OCI image needed. One binary per container; Cloud Run
+        # handles horizontal scaling.
         # Moved AFTER JS compilation to avoid Docker memory pressure killing elc.
         if: steps.changetype.outputs.asset_only != 'true'
         run: |
           set -euo pipefail
-          # Compile el_runtime.o and soul-demo on the host runner
           cc -O2 -DHAVE_CURL -c runtime/el_runtime.c -I runtime/ -o /tmp/el_runtime.o
           cc -O2 -rdynamic -DEL_SOUL_DEMO_BUILD \
              -I runtime/ \
@@ -189,26 +189,6 @@ jobs:
              dist/soul-demo.c dist/vessel_stubs.c /tmp/el_runtime.o \
              -lcurl -lpthread -ldl -lm -lssl -lcrypto
           echo "soul-demo compiled: $(ls -lh dist/soul-demo)"
-          # Package as minimal OCI image for k3s import
-          # --no-cache: prevents reuse of corrupted overlay2 layers from prior failed runs
-          docker build --no-cache -f dist/Dockerfile.soul-demo -t soul-demo:local dist/
-          docker save soul-demo:local -o dist/soul-demo-image.tar
-          echo "soul-demo-image.tar: $(du -sh dist/soul-demo-image.tar | cut -f1)"
-          docker rmi soul-demo:local 2>/dev/null || true
-
-      - name: Download k3s binary
-        # Pre-download k3s on the host runner so Dockerfile.stage can COPY it
-        # directly. Previously k3s was downloaded inside the Docker builder stage,
-        # which combined with build-essential and C compilation caused RWLayer nil
-        # corruption on the runner's overlay2 driver. Host-runner download is safe.
-        if: steps.changetype.outputs.asset_only != 'true'
-        run: |
-          set -euo pipefail
-          curl -fL --retry 3 --retry-delay 10 \
-            https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s \
-            -o dist/k3s
-          chmod +x dist/k3s
-          echo "k3s: $(ls -lh dist/k3s)"
 
       - name: Build and tag image
         if: steps.changetype.outputs.asset_only != 'true'