feat(lua): support process entry security

[skhaz]

Summary

• add security configuration to source and bytecode Lua process entries
• propagate entry policy metadata through factory registration and apply it before process execution
• preserve inherited security baseline across upgrades while removing superseded entry grants
• add SOURCE_DATE_EPOCH support and publish --dry-run --output for reproducible prospective publish artifacts
• fix the existing Windows stderr test to use cmd rather than PowerShell, which held the inherited pipe open

Validation

• make test
• make lint
• focused race-enabled process, security, host, actor, publish, and native executor tests
• Windows native executor package cross-compilation
• targeted source-date and publish-output mutants killed
• built the CLI and ran the full QuickJS validation, including source and packed consumer smoke, against it
• independent security and release reviews: approved

Performance

BenchmarkSchedulerSubmit on Apple M4, GOMAXPROCS=1, 3s x 5: median improved from 3093 ns/op at base to 2283 ns/op.