Replace k3s with direct soul-demo watchdog in Cloud Run container

Cloud Run gen2 doesn't provide eth0 with a unicast IP, causing k3s flannel
to crash on every container start. k3s was also wrong architecture for
Cloud Run (HPA inside a container, k3s overhead for one process).

Changes:
- entrypoint.sh: replace k3s server with a bash watchdog loop that starts
  soul-demo directly and restarts it on crash (3s backoff)
- Dockerfile.stage: remove k3s binary, soul-demo-image.tar, k3s manifests
  and their associated dirs/envvars; keep soul-demo binary only
- stage.yaml: remove 'Download k3s binary' step; rename and simplify
  soul-demo build step to compile binary only (no OCI image/tar)
- dev.yaml: update soul-demo placeholder step (binary not tar)
- manifest.el: document HAVE_CURL requirement since manifest.el has no
  c_flags/link_flags directive support

.gitea/workflows/dev.yaml

@@ -172,11 +172,12 @@ jobs:
       - name: Touch HTML placeholder files
         run: touch src/index.html src/about.html src/terms.html src/enterprise-terms.html
 
-      - name: Create soul-demo-image.tar placeholder
-        # Dockerfile.stage COPYs this file (used by k3s at runtime).
-        # We only need the COPY to succeed here; real tar is built by
-        # build-stage.sh in the deploy pipeline.
-        run: touch dist/soul-demo-image.tar
+      - name: Create soul-demo placeholder
+        # Dockerfile.stage COPYs dist/soul-demo. We only need the binary to exist
+        # for the Docker build to succeed; the real binary is compiled in stage CI.
+        run: |
+          touch dist/soul-demo
+          chmod +x dist/soul-demo
 
       - name: Build Docker image (local only — no push)
         run: |