feat: embed k3s in neuron-web image to run soul-demo as managed pods

soul-demo now runs as a k3s Deployment with HPA (1–8 replicas, 60% CPU
target) instead of a bare background process. k3s starts first in
entrypoint.sh, imports the soul-demo:local OCI tar from
/var/lib/rancher/k3s/agent/images, and auto-applies the Deployment,
NodePort Service, and HPA from the server/manifests dir. neuron-web
starts only after the soul-demo pod is Running. Cloud Run gen2 execution
environment required for k3s (provides /dev/kmsg and Linux capabilities).

dist/Dockerfile.soul-demo

@@ -0,0 +1,13 @@
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends libcurl4 libssl3 ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd -r landing && useradd -r -g landing landing \
+ && mkdir -p /srv/soul/engram-demo \
+ && chown -R landing:landing /srv/soul
+COPY soul-demo /usr/local/bin/soul-demo
+COPY engram-snapshot.json /srv/soul/engram-demo/snapshot.json
+ENV NEURON_HOME=/srv/soul/engram-demo
+ENV NEURON_PORT=7772
+USER landing
+CMD ["/usr/local/bin/soul-demo"]