Replace the CWL-managed Nginx demo runtime with the shared Pingora static edge

[seonghobae]

Current protected-branch defect

At protected main head 128a239f8b71ca16add4b9e15e21752d1ad63ff0, the demo/runtime Dockerfile still ships a CWL-managed Nginx process:

• build stage produces dist-demo;
• runtime stage is pinned nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10;
• files are copied into /usr/share/nginx/html;
• the container runs as the image's nginx user on port 8080; and
• health/entrypoint behavior is owned by Nginx.

This is ACTIVE_RUNTIME, not a historical/reference mention, and conflicts with the merged CWL Pingora edge policy.

Dependency and ownership

Use ContextualWisdomLab/pingora-gateway only after its first runtime is integrated and an actual reviewed artifact or immutable image digest exists. Do not invent a release/tag/digest. If a managed static-hosting/CDN boundary is proven superior for the demo, record that exception explicitly rather than introducing another self-managed reverse proxy.

The shared gateway is a Generic/Supporting edge subdomain. Inkspan owns demo routing, asset/cache semantics and product-specific response policy. Do not move Inkspan behavior into pingora-gateway.

RED characterization before replacement

Capture the current production/demo HTTP behavior through the real built-container path, not source-text assertions alone:

• / and representative hashed/static assets;
• GET and HEAD;
• missing-resource status/body semantics;
• MIME, ETag/Last-Modified and cache behavior actually emitted by the image;
• conditional requests (304) where currently supported;
• byte ranges (206/416) where currently supported;
• port 8080, non-root execution and healthcheck;
• security/response headers required by current clients; and
• graceful termination behavior used by the deployment path.

Record observed behavior rather than assuming stock Nginx defaults.

GREEN acceptance

• no deployable Nginx/OpenResty/ingress-nginx image/package/config/command/runtime path remains;
• the replacement uses a real published pingora-gateway artifact/digest or an accepted managed-hosting boundary;
• Inkspan-specific static semantics remain in an Inkspan edge/deployment adapter or versioned configuration;
• non-root and read-only-root operation, health/readiness and graceful drain are tested;
• container/deployment/CI/operator docs, DDD Context Map/Ubiquitous Language, SECURITY/THREAT_MODEL, TEST_STRATEGY, OPERABILITY/recovery, docs/product-technical-gap-baseline.md, README and CHANGELOG are code-current;
• exact-head CI/security/coverage/SBOM/provenance gates pass; and
• rollback is executable and references a real prior artifact.

Do not mark this issue migrated until the protected default branch contains the replacement and the behavior/security evidence passes.

[seonghobae]

Gateway-owner reconciliation from ContextualWisdomLab/pingora-gateway#50:

Fresh protected truth is still inkspan@main = 720a87fd2155c532e6326dee767bb4b9e5e4d5fc; the active standalone-demo Nginx runtime remains on that head. Issue #394 is already closed as duplicate, so #395 is now the surviving product-owner path rather than a two-issue reconciliation.

One valid acceptance delta from #394 must not be lost in that duplicate closure: #394 explicitly required a real browser smoke of the built demo with no external runtime dependency, and repeated that browser/demo evidence in the final gate. #395 currently covers HTTP/container semantics in more depth (conditional/range behavior, read-only-root, recovery, etc.) but does not state that browser/no-external-runtime acceptance explicitly.

Please preserve that delta in the surviving #395 implementation/evidence before treating #394's duplicate closure as complete succession. This Pingora writer is not changing Inkspan source/docs/PR state and is not prescribing a shared static-file gateway: managed static hosting remains a valid product disposition if self-hosted container delivery is not a current requirement. If self-hosting is retained, keep demo/static semantics Inkspan-owned and consume only a released immutable gateway capability for genuinely reusable edge behavior.