ci: gate the Linux soul on the contract before publishing

Wire the soul contract gate into ci.yaml as a hard block between the cc
build and the Publish-to-Artifact-Registry step. A non-zero gate fails the
build, so a stale (route-404ing) or memory-destroying (hard-deleting) soul
can never publish neuron-soul to foundation-prod or blue-green deploy to
GKE — the same class-fix now guarding the desktop builds, extended to prod.

Vendors scripts/verify-soul-contract.sh (copied from neuron-ui; the route
contract is baked in, so it's portable POSIX bash/curl with no neuron-ui
source dependency). It boots dist/neuron on a throwaway port with a
throwaway HOME/engram/cgi — never touching ~/.neuron or any live service —
and checks PRESENCE (every app route answered) + IMMUTABILITY (no engram
write route hard-deletes; deletes/forgets tombstone). Adds curl to the
build deps for the probe.

.gitea/workflows/ci.yaml

@@ -34,7 +34,7 @@ jobs:
       - name: Install build dependencies
         run: |
           apt-get update -qq
-          apt-get install -y gcc libcurl4-openssl-dev apt-transport-https ca-certificates
+          apt-get install -y gcc curl libcurl4-openssl-dev apt-transport-https ca-certificates
           echo "deb [trusted=yes] https://packages.cloud.google.com/apt cloud-sdk main" \
             > /etc/apt/sources.list.d/google-cloud-sdk.list
           apt-get update -qq && apt-get install -y google-cloud-cli
@@ -107,6 +107,17 @@ jobs:
           strip -s dist/neuron
           ls -lh dist/neuron
 
+      - name: Soul contract gate (HARD BLOCK — no destructive/stale soul publishes)
+        run: |
+          # Boots dist/neuron on a throwaway port with a throwaway HOME/engram/cgi
+          # (never touches ~/.neuron or any live service) and fails the build if any
+          # app-contract route is unanswered (PRESENCE) or any engram write route
+          # hard-deletes instead of tombstoning/superseding (IMMUTABILITY). Non-zero
+          # here blocks Publish -> Artifact Registry -> GKE deploy, so a stale or
+          # memory-destroying soul can never reach prod.
+          chmod +x dist/neuron scripts/verify-soul-contract.sh
+          bash scripts/verify-soul-contract.sh dist/neuron 7796
+
       - name: Smoke test
         run: |
           file dist/neuron