Demo site is live

Served from /site/current inside a rootless container running as its own OS user, reachable only through HAProxy on loopback.

Roll this back with liftedctl rollback demo, or ask the agent to do it.