ci: bump action and tool pins, add Lua 5.5 to the test matrix

[derek-miller]

Summary

Bumps every stale CI pin to the current upstream release (checked 2026-10-17) and adds Lua 5.5 to the test matrix. This is the same change as finitelabs/lua-crypto#17, finitelabs/lua-bitn#25, finitelabs/lua-bthome-ble#19 and finitelabs/lua-noiseprotocol#30. The highest-priority bump is softprops/action-gh-release v1, which runs on Node 16. GitHub has retired that runtime, so the release job was at risk.

Pin	From	To	Breaking-change notes that apply
softprops/action-gh-release (release.yml)	v1	v3 (3.0.3)	Runtime only: v2 moved to Node 20 and v3 to Node 24. Every input we pass still exists in v3. tag_name: ${{ github.ref }} is still stripped of refs/tags/ (normalizeTagName). Since v2.5.0 the release is created as a draft and published once all assets are uploaded.
actions/checkout	v4	v7	v5/v6 moved to Node 24 (runner ≥ 2.327.1) and v6 persists credentials to a separate file. v7 blocks fork-PR checkout under pull_request_target/workflow_run, which we don't use. None of this affects us.
actions/upload-artifact	v4	v7	v5/v6 moved to Node 24. v7 is ESM and adds an opt-in archive: false. The default stays zipped, so the artifact is unchanged.
leafo/gh-actions-lua	v11	v13	v13 makes 5.5 the default luaVersion, but every job here sets luaVersion explicitly. The 5.4 alias now resolves to 5.4.8 and 5.5 to 5.5.0.
leafo/gh-actions-luarocks	v5	v6 (6.1.0)	Node 24 and ESM; inputs unchanged.
LuaRocks	3.12.2	3.13.0	—
JohnnyMorganz/stylua-action	v4	v5	Node 24 only. args: false (install without running) is still supported.
StyLua	v2.1.0	v2.6.0	See below.
lua-language-server	3.19.0	3.19.2	See below.
actions/setup-python (check job)	v5	v7 (7.0.0)	v6 moved to Node 24. v7 is ESM and removes the pip-install input, which we don't use. python-version: '3.12' is unchanged.
Test matrix	5.1–5.4, LuaJIT 2.0/2.1	+ 5.5	./run_tests.sh all passes 8/8 under a local Lua 5.5.1 with no source changes. In CI the 5.5 alias builds 5.5.0. The luajit-2.1 → luajit-openresty mapping is untouched and still in gh-actions-lua v13's LUAJIT_REPOS.

Under StyLua 2.6.0 make format-check reports no diffs, and under lua-language-server 3.19.2 make typecheck finds no problems. check-provenance, check-types, check-schema, check-wire-vectors and check-float-vectors all pass too. So src/ and types.lua are unchanged.

CLAUDE.md (the LuaLS pin, the "3.18.2 and 3.19.0 agree" note, now including 3.19.2, the CI test-matrix line, and the note that CI covers more than the local luaenv matrix) and README's supported-versions line are updated to match.

Test plan

• make check passes locally with StyLua 2.6.0, lua-language-server 3.19.2, and a fresh .venv from tools/requirements.txt (protobuf 4.25.9, matching CI)
• make check-wire-vectors and make check-float-vectors pass
• make test-all passes under LuaJIT 2.1 (8/8)
• LUA_BINARY=lua5.5 ./run_tests.sh all passes (Lua 5.5.1, 8/8)
• CI is green across check, the test matrix (including the new 5.5 leg) and build
• The release workflow is next exercised on the next v* tag

[svc-finitelabs]

Reviewed at 3004a65. All 9 checks green. The new Lua 5.5 leg built 5.5.0 and ran the full suite (812 PASS, 0 FAIL), and Check ran StyLua v2.6.0 and lua-language-server 3.19.2 with "no problems found". Locally, ./run_tests.sh all also passes under Lua 5.5.0 and LuaJIT 2.1.

release.yml: every input passed to softprops/action-gh-release@v3 (draft, prerelease, name, tag_name, generate_release_notes, files) still exists in v3. That job only runs on a v* tag, so the first real test is the next release.

Docs match the workflow. CLAUDE.md now says outright that the local test-matrix doesn't cover 5.5, which is better than the twin PRs, where run_tests_matrix.sh silently lacks it.

Non-blocking:

• vendor/bitn.lua docstrings still say "5.1, 5.2, 5.3, 5.4, and LuaJIT". That's vendored text, so it gets fixed upstream in lua-bitn and comes in on the next vendor sync, not here.
• The body has no YouTrack reference.