HF demo: block chat submissions and guide local edge install; add optional virgin-system runtime config

HF deploy snapshot (no app.db)