fix(deploy): onnxruntime is a runtime dependency; bake the demo model into the image

[Thomasbehan]

Fixes the Render deployment.

onnxruntime was missing from base requires

The demo now serves the JEPA family by default (#71), and its encoder loads through onnxruntime — but onnxruntime was declared only in the optional [jepa] training extra. The Dockerfile runs pip install -e ., i.e. base requires only, so the container imports cleanly and then raises ModuleNotFoundError: onnxruntime on the first /predict.

This is a bug I introduced when changing the default predictor; the dependency became a runtime one and the packaging didn't follow.

The image fetched a model the demo no longer serves

The Dockerfile pulled the old M-4s Keras model. The demo now serves JEPA medium, so the image now bakes that in instead. It could self-heal at runtime — _ensure_jepa_model downloads on demand — but that would make the first request after a cold start pull 318 MB, which on Render's free tier will time out and look like a broken app.

Verified locally

extract path matches Dockerfile test: OK
predictor loaded from baked-in path: JEPADemoPredictor | precision fp32

The exact curl … | tar xz -C models/jepa from the Dockerfile was run, then _get_predictor() loaded it with no environment overrides — the same path the container takes.

Test plan

• ruff check clean
• 100 tests pass (1 pre-existing Windows-only symlink failure)
• Dockerfile fetch/extract verified end-to-end against the real release asset

Note: this addresses a runtime failure I can prove. If Render is failing at build time, that may be separate — TensorFlow 2.21 is a very heavy base dependency for a container that no longer needs it for the demo path. I'd want the actual build log before changing that.