ci: bump action and tool pins, add Lua 5.5 to the test matrix

[derek-miller]

Summary

Bumps every stale CI pin to the current upstream release (checked 2026-10-17) and adds Lua 5.5 to the test matrix. This is the same change as finitelabs/lua-crypto#17. The highest-priority bump is softprops/action-gh-release v1, which runs on Node 16. GitHub has retired that runtime, so the release job was at risk.

Pin	From	To	Breaking-change notes that apply
softprops/action-gh-release (release.yml)	v1	v3 (3.0.3)	Runtime only: v2 moved to Node 20 and v3 to Node 24. Every input we pass still exists in v3. tag_name: ${{ github.ref }} is still stripped of refs/tags/ (normalizeTagName). Since v2.5.0 the release is created as a draft and published once all assets are uploaded.
actions/checkout	v4	v7	v5/v6 moved to Node 24 (runner ≥ 2.327.1) and v6 persists credentials to a separate file. v7 blocks fork-PR checkout under pull_request_target/workflow_run, which we don't use. None of this affects us.
actions/upload-artifact	v4	v7	v5/v6 moved to Node 24. v7 is ESM and adds an opt-in archive: false. The default stays zipped, so the artifact is unchanged.
leafo/gh-actions-lua	v11	v13	v13 makes 5.5 the default luaVersion, but every job here sets luaVersion explicitly. The 5.4 alias now resolves to 5.4.8 and 5.5 to 5.5.0.
leafo/gh-actions-luarocks	v5	v6 (6.1.0)	Node 24 and ESM; inputs unchanged.
LuaRocks	3.12.2	3.13.0	—
JohnnyMorganz/stylua-action	v4	v5	Node 24 only. args: false (install without running) is still supported.
StyLua	v2.1.0	v2.6.0	See below.
lua-language-server	3.19.0	3.19.2	See below.
Test matrix	5.1–5.4, LuaJIT 2.0/2.1	+ 5.5	The suite passes 5/5 under a local Lua 5.5.1 with no source changes. On 5.5 bitn selects its native-operator backend (native operators (Lua 5.3+)), not a fallback. In CI the 5.5 alias builds 5.5.0.

Under StyLua 2.6.0 make format-check reports no diffs, and under lua-language-server 3.19.2 make typecheck finds no problems. So src/ is unchanged.

CLAUDE.md (the LuaLS pin, the CI test-matrix line, and the note that CI covers more than the local luaenv matrix) and README's supported-versions line are updated to match.

Test plan

• make check passes locally with StyLua 2.6.0 and lua-language-server 3.19.2
• make test passes (LuaJIT 2.1)
• LUA_BINARY=lua5.5 ./run_tests.sh passes (Lua 5.5.1, 5/5)
• CI is green across check, the test matrix (including the new 5.5 leg) and build
• The release workflow is next exercised on the next v* tag

[svc-finitelabs]

Reviewed at 95d0c99. All 9 checks pass. The new 5.5 leg built Lua 5.5.0 and the suite reports Using: native operators (Lua 5.3+), so it exercises the real backend and not a fallback. The pin bumps match lua-crypto#17. The action-gh-release@v3 step still passes draft, prerelease, name, tag_name, generate_release_notes and files, all of which v3 supports. That job can't run until a tag is cut, which the test plan already says.

Non-blocking:

• src/bitn/init.lua:5: the module doc still says "Lua 5.1, 5.2, 5.3, 5.4, and LuaJIT". README now lists 5.5, so the two disagree.
• run_tests_matrix.sh:14 doesn't include 5.5. CLAUDE.md now documents that CI covers more than the local matrix, so that's fine if it's on purpose.
• The body has no YouTrack reference.