Add optional LuaJIT backend behind an engine-neutral scripting seam

[mmcdole]

Summary

Rune's scripting layer now drives its Lua engine through an engine-neutral seam (script package) with two backends: gopher-lua (pure Go, the default — unchanged behavior, no cgo) and LuaJIT 2.1 behind -tags luajit. A pathfinding-shaped benchmark runs ~39x faster on the LuaJIT build (563µs → 14.3µs per iteration through the real engine path).

The seam

script.Engine and script.Call define the whole contract: values obtained during a host call die with the call scope, retaining a script function requires an explicit pin, composite data crosses the boundary as Go trees in single passes, and host functions return errors instead of manipulating a stack. All seventeen API modules, the line type, and the engine dispatch paths are ported. The existing engine test suite passes unchanged on both backends and serves as the backend conformance contract (go test ./lua/ and go test -tags luajit ./lua/).

The scoped-value contract is what keeps the LuaJIT backend simple: registry references are scope-owned and released deterministically — no finalizers, no GC coupling.

Notable fixes along the way

• Two core-script bugs that only worked by gopher-lua leniency: hooks.call truncated argument lists at an embedded nil (GMCP messages with no body lost their raw argument), and rune.caller_source broke under real Lua 5.1 tail-call elimination. Both fixed engine-agnostically.
• A probabilistic whole-JIT failure on macOS arm64: LuaJIT's trace machine code must sit within ±128MB of its VM, probed at randomized addresses, and in a Go process that window is often crowded — a losing process thrashes compile/fail/flush and runs slower than gopher-lua. Fixed by static linking plus a loader constructor that reserves branch-range address space before the Go runtime can claim it. TestJITMcodeAllocation reads LuaJIT's own trace log and fails on any mcode allocation failure.

Known caveat

The watchdog cannot interrupt a JIT-compiled loop that never exits its trace (compiled code does not poll debug hooks). Loops touching any host function abort traces and stay interruptible — the realistic runaway class in a scripted client. A bare while true do end does not; every shipping JIT-Lua MUD client has the same exposure. Documented in docs/luajit.md.

CI/CD

• CI gains a luajit job (Linux, macOS, Windows) running vet and the race-enabled engine suite, so the JIT backend is validated on every push.
• Releases now attach rune-jit archives (macOS arm64, Linux amd64/arm64, Windows amd64) alongside the goreleaser-built pure rune binaries. Each jit build runs its platform's engine suite first and is gated on being statically linked, so testers need no LuaJIT installed. Beta-style tags publish as prereleases.
• Windows builds a static libluajit.a from source with mingw-w64 via a composite action; the mcode reservation is POSIX-gated (x64's ±2GB branch range makes the failure mode unlikely there).

Note for reviewers

The Windows lane is validated by construction but has not yet executed — this PR's CI run is its first real test.

[codecov]

Codecov Report

❌ Patch coverage is 70.89552% with 312 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.06%. Comparing base (8c40c15) to head (ea96d68).

Files with missing lines	Patch %	Lines
script/gopherlua/engine.go	69.12%	73 Missing and 19 partials ⚠️
script/value.go	68.75%	29 Missing and 6 partials ⚠️
lua/api_ui.go	44.06%	33 Missing ⚠️
script/call.go	43.63%	25 Missing and 6 partials ⚠️
lua/api_store.go	58.53%	14 Missing and 3 partials ⚠️
lua/api_core.go	62.79%	16 Missing ⚠️
lua/api_bar.go	71.15%	10 Missing and 5 partials ⚠️
lua/api_gmcp.go	56.25%	12 Missing and 2 partials ⚠️
lua/engine.go	82.50%	4 Missing and 10 partials ⚠️
script/script.go	48.14%	14 Missing ⚠️
... and 11 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #83      +/-   ##
==========================================
- Coverage   70.79%   70.06%   -0.74%     
==========================================
  Files          60       65       +5     
  Lines        4726     4981     +255     
==========================================
+ Hits         3346     3490     +144     
- Misses       1197     1309     +112     
+ Partials      183      182       -1     

Files with missing lines	Coverage Δ
lua/api_session.go	100.00% <100.00%> (ø)
lua/api_state.go	100.00% <100.00%> (+9.52%)	⬆️
cmd/rune/main.go	47.05% <0.00%> (ø)
lua/backend_gopher.go	50.00% <50.00%> (ø)
lua/api_http.go	95.00% <93.75%> (+7.50%)	⬆️
lua/api_input.go	95.12% <95.00%> (+1.94%)	⬆️
lua/line.go	86.66% <86.66%> (-4.25%)	⬇️
lua/api_bind.go	70.83% <81.25%> (+9.29%)	⬆️
lua/api_log.go	87.50% <86.95%> (+2.88%)	⬆️
lua/api_picker.go	86.95% <89.47%> (+5.82%)	⬆️
... and 13 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.