A14: Embed Lua 5.4 runtime #134

Summary

Embed Lua 5.4 as a sandboxed scripting runtime for the intermediate modding tier. Lua scripts are loaded as modules via TOML lua = "path" entries.

Requirements

• Embed Lua 5.4 (single C file compilation)
• Sandbox: remove io, os, debug, loadfile, dofile, package
• Keep: string, table, math, coroutine (limited), utf8
• Memory limit: 16MB default per Lua state
• Instruction limit: 1M per handler invocation
• Each Lua module runs in its own Lua state (no shared variables)

Reference

• Lua Scripting Guide

Acceptance Criteria

• Lua 5.4 compiles into the engine
• Sandbox removes dangerous standard libraries
• Memory and instruction limits enforced
• Lua scripts load via lua = "path" in TOML
• Unit tests for sandbox enforcement

Depends on: #122 (module loader), #121 (event bus)
Blocks: #120