Replace k3s with direct soul-demo watchdog in Cloud Run container

Cloud Run gen2 doesn't provide eth0 with a unicast IP, causing k3s flannel
to crash on every container start. k3s was also wrong architecture for
Cloud Run (HPA inside a container, k3s overhead for one process).

Changes:
- entrypoint.sh: replace k3s server with a bash watchdog loop that starts
  soul-demo directly and restarts it on crash (3s backoff)
- Dockerfile.stage: remove k3s binary, soul-demo-image.tar, k3s manifests
  and their associated dirs/envvars; keep soul-demo binary only
- stage.yaml: remove 'Download k3s binary' step; rename and simplify
  soul-demo build step to compile binary only (no OCI image/tar)
- dev.yaml: update soul-demo placeholder step (binary not tar)
- manifest.el: document HAVE_CURL requirement since manifest.el has no
  c_flags/link_flags directive support

Dockerfile.stage

@@ -4,15 +4,13 @@
 #   - neuron-web  on port 8080 (landing page server)
 #   - soul-demo   on port 7772 (demo chat, localhost only)
 #
-# All binaries (neuron-web, soul-demo, k3s) are pre-built by CI on the host
-# runner before this Dockerfile runs. This keeps the Docker build single-stage
-# with no compilation and no network downloads, eliminating the multi-stage
-# complexity that caused RWLayer corruption on the runner's overlay2 driver.
+# All binaries (neuron-web, soul-demo) are pre-built by CI on the host runner
+# before this Dockerfile runs. This keeps the Docker build single-stage with
+# no compilation and no network downloads.
 #
 # CI pre-build steps (in stage.yaml):
 #   - neuron-web: built by `elb build` → dist/neuron-landing
 #   - soul-demo:  compiled by cc on host → dist/soul-demo
-#   - k3s:        downloaded by curl on host → dist/k3s
 
 FROM ubuntu:24.04
 
@@ -27,9 +25,7 @@ RUN apt-get update \
  && groupadd -r landing && useradd -r -g landing landing \
  && mkdir -p /srv/landing/assets /srv/landing/js /srv/landing/shares \
  && mkdir -p /srv/soul/engram-demo \
- && chown -R landing:landing /srv/landing /srv/soul \
- && mkdir -p /var/lib/rancher/k3s /tmp/k3s \
- && chown -R landing:landing /var/lib/rancher /tmp/k3s
+ && chown -R landing:landing /srv/landing /srv/soul
 
 # neuron-web binary — produced by `elb build` in CI (linux/amd64)
 COPY dist/neuron-landing /usr/local/bin/neuron-web
@@ -39,18 +35,6 @@ RUN chmod +x /usr/local/bin/neuron-web
 COPY dist/soul-demo /usr/local/bin/soul-demo
 RUN chmod +x /usr/local/bin/soul-demo
 
-# k3s binary — downloaded from GitHub releases by CI
-COPY dist/k3s /usr/local/bin/k3s
-RUN chmod +x /usr/local/bin/k3s
-
-# soul-demo OCI image tar — k3s imports this at startup (no registry needed)
-RUN mkdir -p /var/lib/rancher/k3s/agent/images
-COPY dist/soul-demo-image.tar /var/lib/rancher/k3s/agent/images/soul-demo.tar
-
-# k3s manifests — auto-applied when k3s starts
-RUN mkdir -p /var/lib/rancher/k3s/server/manifests
-COPY dist/k3s-soul-demo.yaml /var/lib/rancher/k3s/server/manifests/soul-demo.yaml
-
 # Engram snapshot — baked in so soul has memory from cold start
 COPY dist/engram-snapshot.json /srv/soul/engram-demo/snapshot.json
 
@@ -73,11 +57,7 @@ ENV LANDING_ROOT=/srv/landing
 ENV PORT=8080
 ENV NEURON_HOME=/srv/soul/engram-demo
 ENV NEURON_PORT=7772
-ENV K3S_DATA_DIR=/var/lib/rancher/k3s
-ENV KUBECONFIG=/var/lib/rancher/k3s/server/cred/admin.kubeconfig
 
-# k3s requires root to create network namespaces and mount cgroups.
-# Cloud Run gen2 sandbox is the security boundary here.
 EXPOSE 8080
 
 CMD ["/usr/local/bin/entrypoint.sh"]