Replace k3s with direct soul-demo watchdog in Cloud Run container

Cloud Run gen2 doesn't provide eth0 with a unicast IP, causing k3s flannel
to crash on every container start. k3s was also wrong architecture for
Cloud Run (HPA inside a container, k3s overhead for one process).

Changes:
- entrypoint.sh: replace k3s server with a bash watchdog loop that starts
  soul-demo directly and restarts it on crash (3s backoff)
- Dockerfile.stage: remove k3s binary, soul-demo-image.tar, k3s manifests
  and their associated dirs/envvars; keep soul-demo binary only
- stage.yaml: remove 'Download k3s binary' step; rename and simplify
  soul-demo build step to compile binary only (no OCI image/tar)
- dev.yaml: update soul-demo placeholder step (binary not tar)
- manifest.el: document HAVE_CURL requirement since manifest.el has no
  c_flags/link_flags directive support

dist/entrypoint.sh

@@ -1,41 +1,26 @@
 #!/bin/sh
 set -e
 
-# SKIP_K3S=1 — bypass k3s/soul-demo startup and go straight to neuron-web.
-# Used by the dev CI smoke test where the container runtime doesn't support
-# the kernel capabilities k3s requires (overlayfs / privileged mode).
 if [ "${SKIP_K3S:-0}" = "1" ]; then
-  echo "[entrypoint] SKIP_K3S=1: starting neuron-web directly (no k3s/soul-demo)."
+  echo "[entrypoint] SKIP_K3S=1: starting neuron-web directly (no soul-demo)."
   exec /usr/local/bin/neuron-web
 fi
 
-echo "[entrypoint] Starting k3s server (embedded soul-demo orchestrator)..."
+# Soul-demo watchdog: start soul-demo and restart it automatically on crash.
+# Cloud Run gen2 doesn't reliably provide eth0 with a unicast IP, so k3s flannel
+# fails at startup. Running soul-demo directly is simpler, lighter, and fully
+# self-healing. Cloud Run handles horizontal scaling — no HPA needed.
+echo "[entrypoint] Starting soul-demo watchdog on :${NEURON_PORT:-7772}..."
+(
+  while true; do
+    echo "[soul-watchdog] starting soul-demo (NEURON_HOME=${NEURON_HOME})"
+    /usr/local/bin/soul-demo 2>&1 || true
+    echo "[soul-watchdog] soul-demo exited, restarting in 3s..."
+    sleep 3
+  done
+) &
 
-# k3s server — single-node mode, disable unused components
-# --disable traefik,servicelb: we don't need an ingress or LB
-# --disable metrics-server: saves ~50MB RAM
-# --write-kubeconfig-mode=644: allow non-root reads
-# --data-dir: use the pre-chowned dir
-# --flannel-iface=eth0: explicitly set the network interface.
-#   Cloud Run gen2 provides eth0 but k3s default IP detection walks the routing
-#   table looking for a default route, which fails in Cloud Run's network sandbox.
-#   Pinning to eth0 bypasses that detection and lets k3s bind correctly.
-k3s server \
-  --disable traefik \
-  --disable servicelb \
-  --disable metrics-server \
-  --write-kubeconfig-mode=644 \
-  --data-dir /var/lib/rancher/k3s \
-  --node-name soul-node \
-  --flannel-iface=eth0 &
-
-K3S_PID=$!
-
-# Start neuron-web immediately — do NOT block on k3s becoming ready.
-# Cloud Run's startup probe requires port 8080 to be listening within the
-# startup timeout. k3s may take 30-60s to initialise; blocking here causes
-# probe failures and container termination before neuron-web ever starts.
-# soul-demo becomes available asynchronously once k3s is ready. neuron-web
-# handles soul-demo being temporarily unavailable gracefully.
-echo "[entrypoint] Starting neuron-web on port ${PORT:-8080} (k3s initialising in background)..."
+# Start neuron-web immediately — do NOT block.
+# Cloud Run startup probe requires port 8080 to answer within the timeout.
+echo "[entrypoint] Starting neuron-web on port ${PORT:-8080}..."
 exec /usr/local/bin/neuron-web