feat: embed k3s in neuron-web image to run soul-demo as managed pods

soul-demo now runs as a k3s Deployment with HPA (1–8 replicas, 60% CPU
target) instead of a bare background process. k3s starts first in
entrypoint.sh, imports the soul-demo:local OCI tar from
/var/lib/rancher/k3s/agent/images, and auto-applies the Deployment,
NodePort Service, and HPA from the server/manifests dir. neuron-web
starts only after the soul-demo pod is Running. Cloud Run gen2 execution
environment required for k3s (provides /dev/kmsg and Linux capabilities).

Dockerfile.stage

@@ -17,6 +17,7 @@ FROM debian:bookworm-slim AS builder
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         build-essential \
+        curl \
         libcurl4-openssl-dev \
         libssl-dev \
         ca-certificates \
@@ -41,6 +42,10 @@ RUN cc -O2 -rdynamic \
        soul-demo.c vessel_stubs.c el_runtime.o \
        -lcurl -lpthread -ldl -lm -lssl -lcrypto
 
+# ── Download k3s binary ───────────────────────────────────────────────────────
+RUN curl -fL https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s -o /usr/local/bin/k3s \
+ && chmod +x /usr/local/bin/k3s
+
 # ── Stage 2: runtime image ────────────────────────────────────────────────────
 FROM debian:bookworm-slim
 
@@ -53,7 +58,9 @@ RUN apt-get update \
  && groupadd -r landing && useradd -r -g landing landing \
  && mkdir -p /srv/landing/assets /srv/landing/js /srv/landing/shares \
  && mkdir -p /srv/soul/engram-demo \
- && chown -R landing:landing /srv/landing /srv/soul
+ && chown -R landing:landing /srv/landing /srv/soul \
+ && mkdir -p /var/lib/rancher/k3s /tmp/k3s \
+ && chown -R landing:landing /var/lib/rancher /tmp/k3s
 
 # neuron-web binary — produced by `elb build` in CI (linux/amd64)
 COPY dist/neuron-landing /usr/local/bin/neuron-web
@@ -61,6 +68,17 @@ RUN chmod +x /usr/local/bin/neuron-web
 
 COPY --from=builder /build/soul-demo /usr/local/bin/soul-demo
 
+# k3s binary
+COPY --from=builder /usr/local/bin/k3s /usr/local/bin/k3s
+
+# soul-demo OCI image tar — k3s imports this at startup (no registry needed)
+RUN mkdir -p /var/lib/rancher/k3s/agent/images
+COPY dist/soul-demo-image.tar /var/lib/rancher/k3s/agent/images/soul-demo.tar
+
+# k3s manifests — auto-applied when k3s starts
+RUN mkdir -p /var/lib/rancher/k3s/server/manifests
+COPY dist/k3s-soul-demo.yaml /var/lib/rancher/k3s/server/manifests/soul-demo.yaml
+
 # Engram snapshot — baked in so soul has memory from cold start
 COPY dist/engram-snapshot.json /srv/soul/engram-demo/snapshot.json
 
@@ -83,6 +101,8 @@ ENV LANDING_ROOT=/srv/landing
 ENV PORT=8080
 ENV NEURON_HOME=/srv/soul/engram-demo
 ENV NEURON_PORT=7772
+ENV K3S_DATA_DIR=/var/lib/rancher/k3s
+ENV KUBECONFIG=/var/lib/rancher/k3s/server/cred/admin.kubeconfig
 
 USER landing
 EXPOSE 8080