ci: bump action and tool pins, add Lua 5.5 to the test matrix

[derek-miller]

Summary

Bumps every stale CI pin to the current upstream release (checked 2026-10-17) and adds Lua 5.5 to the test matrix. The highest-priority bump is softprops/action-gh-release v1, which runs on Node 16. GitHub has retired that runtime, so the release job was at risk.

Pin	From	To	Breaking-change notes that apply
softprops/action-gh-release (release.yml)	v1	v3 (3.0.3)	Runtime only: v2 moved to Node 20 and v3 to Node 24. Every input we pass still exists in v3. tag_name: ${{ github.ref }} is still stripped of refs/tags/ (normalizeTagName). Since v2.5.0 the release is created as a draft and published once all assets are uploaded, so a failed upload leaves a draft instead of a half-populated release.
actions/checkout	v4	v7	v5/v6 moved to Node 24 (runner ≥ 2.327.1) and v6 persists credentials to a separate file. v7 blocks fork-PR checkout under pull_request_target/workflow_run, which we don't use. None of this affects us.
actions/upload-artifact	v4	v7	v5/v6 moved to Node 24. v7 is ESM and adds an opt-in archive: false. The default stays zipped, so the crypto.lua artifact is unchanged.
leafo/gh-actions-lua	v11	v13	v13 makes 5.5 the default luaVersion, but every job here sets luaVersion explicitly. The 5.4 alias now resolves to 5.4.8 and 5.5 to 5.5.0.
leafo/gh-actions-luarocks	v5	v6 (6.1.0)	Node 24 and ESM; inputs unchanged.
LuaRocks	3.12.2	3.13.0	—
JohnnyMorganz/stylua-action	v4	v5	Node 24 only. args: false (install without running) is still supported.
StyLua	v2.1.0	v2.6.0	make format-check under 2.6.0 reports no diffs, so src/ is unchanged.
lua-language-server	3.19.0	3.19.2	make typecheck: no problems found.
Test matrix	5.1–5.4, LuaJIT 2.0/2.1	+ 5.5	The full suite passes under a local Lua 5.5.1 (16/16) with no source changes, vendored bitn included. In CI the 5.5 alias builds 5.5.0.

CLAUDE.md (the LuaLS pin and the CI test-matrix line) and README's supported-versions line are updated to match.

Left alone because they are already current: the lua-openssl rocks (0.11.1-1 is the newest), vendored bitn (v0.6.4) and the ubuntu-26.04 runners.

Test plan

• make check passes locally with StyLua 2.6.0 and lua-language-server 3.19.2
• make test passes (LuaJIT 2.1)
• LUA_BINARY=lua5.5 ./run_tests.sh passes (Lua 5.5.1, 16/16)
• actionlint reports only pre-existing findings: its bundled runner list doesn't know ubuntu-26.04, and SC2193 fires on the existing luajit* glob test
• CI is green across check, the test matrix (including the new 5.5 leg), openssl-matrix (lua-openssl 0.8.5 now builds against Lua 5.4.8 / LuaRocks 3.13.0), and build
• The release workflow is next exercised on the next v* tag

[svc-finitelabs]

Looks good. CI is green at 1df8393 across all 12 checks. The new Lua 5.5 leg really runs a 5.5 interpreter (Lua 5.5.0 banner in the job log, every suite passing), and Build Combined Module covers the upload-artifact@v7 step.

The release job won't run until the next tag, so I checked it by hand: softprops/action-gh-release@v3 is node24 and still declares every input release.yml passes (draft, prerelease, name, tag_name, generate_release_notes, files). permissions: contents: write is already set.

Two optional follow-ups, neither blocking:

• src/crypto/init.lua:6: the module doc still says "Runs on Lua 5.1, 5.2, 5.3, 5.4, and LuaJIT". It now disagrees with the README line this PR updates.
• run_tests_matrix.sh still lists only 5.1.5 to 5.4.8 plus LuaJIT, so make test-matrix doesn't cover 5.5 locally. CLAUDE.md:327 ("across Lua 5.1–5.4 + LuaJIT") is accurate for that script as it stands. If you want local parity, add a 5.5 entry there and update that line too.