feat: embed k3s in neuron-web image to run soul-demo as managed pods

soul-demo now runs as a k3s Deployment with HPA (1–8 replicas, 60% CPU
target) instead of a bare background process. k3s starts first in
entrypoint.sh, imports the soul-demo:local OCI tar from
/var/lib/rancher/k3s/agent/images, and auto-applies the Deployment,
NodePort Service, and HPA from the server/manifests dir. neuron-web
starts only after the soul-demo pod is Running. Cloud Run gen2 execution
environment required for k3s (provides /dev/kmsg and Linux capabilities).

dist/entrypoint.sh

@@ -1,21 +1,35 @@
-#!/usr/bin/env bash
-# entrypoint.sh — Start soul-demo then neuron-web in the same container.
-#
-# soul-demo runs in the background on :7772 (localhost only, not exposed).
-# neuron-web runs in the foreground on :8080 (Cloud Run health checks this).
-# If neuron-web exits, the container exits. Soul crashing is non-fatal —
-# chat will return "demo soul not responding" but the page stays up.
+#!/bin/sh
+set -e
 
-set -euo pipefail
+echo "[entrypoint] Starting k3s server (embedded soul-demo orchestrator)..."
 
-echo "[entrypoint] starting soul-demo on :7772"
-/usr/local/bin/soul-demo &
-SOUL_PID=$!
+# k3s server — single-node mode, disable unused components
+# --disable traefik,servicelb: we don't need an ingress or LB
+# --disable metrics-server: saves ~50MB RAM
+# --write-kubeconfig-mode=644: allow non-root reads
+# --data-dir: use the pre-chowned dir
+k3s server \
+  --disable traefik \
+  --disable servicelb \
+  --disable metrics-server \
+  --write-kubeconfig-mode=644 \
+  --data-dir /var/lib/rancher/k3s \
+  --node-name soul-node &
 
-# Give the soul a few seconds to load its engram and seed safety nodes
-sleep 4
+K3S_PID=$!
 
-echo "[entrypoint] soul-demo started (pid=$SOUL_PID)"
-echo "[entrypoint] starting neuron-web on :${PORT:-8080}"
+echo "[entrypoint] Waiting for k3s to become ready..."
+until k3s kubectl get nodes --no-headers 2>/dev/null | grep -q "Ready"; do
+  sleep 2
+done
+echo "[entrypoint] k3s ready. soul-demo Deployment will be applied automatically from manifests."
 
+# Wait for soul-demo pod to be Running before starting neuron-web
+echo "[entrypoint] Waiting for soul-demo pod..."
+until k3s kubectl get pods -l app=soul-demo --no-headers 2>/dev/null | grep -q "Running"; do
+  sleep 3
+done
+echo "[entrypoint] soul-demo is running."
+
+echo "[entrypoint] Starting neuron-web on port ${PORT:-8080}..."
 exec /usr/local/bin/neuron-web