feat: embed k3s in neuron-web image to run soul-demo as managed pods

soul-demo now runs as a k3s Deployment with HPA (1–8 replicas, 60% CPU
target) instead of a bare background process. k3s starts first in
entrypoint.sh, imports the soul-demo:local OCI tar from
/var/lib/rancher/k3s/agent/images, and auto-applies the Deployment,
NodePort Service, and HPA from the server/manifests dir. neuron-web
starts only after the soul-demo pod is Running. Cloud Run gen2 execution
environment required for k3s (provides /dev/kmsg and Linux capabilities).

build-stage.sh

@@ -43,4 +43,22 @@ docker build \
     -t "marketing:${TAG}" \
     .
 
+# Extract soul-demo binary and engram snapshot from built image
+echo "==> Packaging soul-demo:local image for k3s..."
+CONTAINER_ID=$(docker create "marketing:${TAG}")
+docker cp "${CONTAINER_ID}:/usr/local/bin/soul-demo" dist/soul-demo
+docker cp "${CONTAINER_ID}:/srv/soul/engram-demo/snapshot.json" dist/soul-demo-snapshot.json 2>/dev/null || true
+docker rm "${CONTAINER_ID}"
+
+# Build minimal soul-demo container image
+cp dist/soul-demo-snapshot.json dist/engram-snapshot.json 2>/dev/null || true
+docker build \
+  -f dist/Dockerfile.soul-demo \
+  -t soul-demo:local \
+  dist/
+
+# Save as OCI tar for k3s to import at startup
+docker save soul-demo:local -o dist/soul-demo-image.tar
+echo "==> soul-demo:local image saved ($(du -sh dist/soul-demo-image.tar | cut -f1))"
+
 echo "==> Done. marketing:${TAG} built."