feat(ext): add extension discovery and loading

Extension discovery (plan todo 20): scans --ext-dir dirs,
STUPIDTOOLS_EXT, the XDG user dir and a builtin-ext dir for *.lua
modules, runs each in the sandboxed Lua runtime, and enumerates its
registrations; the builtin C/C++ modules load first via
st_ext_init_builtins. Fail-fast with an error naming file and line on
any malformed/sandbox-violating module.

The CLI gains a repeatable --ext-dir flag; with flag or env present
main.c runs discovery and prints 'loaded extension: ...' lines from
actual registrations (interim wiring until todo 23).

Note: src/Makefile.am gained the ext + vendored Lua sources because
the binary otherwise cannot link discovery -- required for the
root-verifiable CLI acceptance.

src/Makefile.am

@@ -3,5 +3,28 @@
 AM_CFLAGS = -std=c23 -Wall -Wextra -Wpedantic
 
 bin_PROGRAMS = stupidtools
-stupidtools_SOURCES = main.c cli.c
-noinst_HEADERS = cli.h
+stupidtools_SOURCES = \
+	main.c cli.c \
+	error.c span.c \
+	ext/discovery.c ext/lua.c ext/abi.c ext/lang_c.c ext/lang_cpp.c \
+	../thirdparty/lua/lapi.c ../thirdparty/lua/lauxlib.c \
+	../thirdparty/lua/lbaselib.c ../thirdparty/lua/lcode.c \
+	../thirdparty/lua/lctype.c ../thirdparty/lua/ldebug.c \
+	../thirdparty/lua/ldo.c ../thirdparty/lua/ldump.c \
+	../thirdparty/lua/lfunc.c ../thirdparty/lua/lgc.c \
+	../thirdparty/lua/llex.c ../thirdparty/lua/lmem.c \
+	../thirdparty/lua/lobject.c ../thirdparty/lua/lopcodes.c \
+	../thirdparty/lua/lparser.c ../thirdparty/lua/lstate.c \
+	../thirdparty/lua/lstring.c ../thirdparty/lua/ltable.c \
+	../thirdparty/lua/ltm.c ../thirdparty/lua/lundump.c \
+	../thirdparty/lua/lvm.c ../thirdparty/lua/lzio.c \
+	../thirdparty/lua/lstrlib.c ../thirdparty/lua/ltablib.c
+
+# The vendored Lua subset above deliberately EXCLUDES linit.c,
+# lmathlib.c, loadlib.c, liolib.c, loslib.c, ldblib.c, lcorolib.c,
+# lutf8lib.c and the lua.c/luac.c mains -- see src/ext/lua.c's -lm note
+# (the runtime's curated math/os tables replace lmathlib/loslib, and
+# the six libm shims in lua.c keep the link free of -lm).
+noinst_HEADERS = cli.h error.h span.h \
+	ext/discovery.h ext/lua.h ext/abi.h ext/lang_c.h ext/lang_cpp.h \
+	ext/lang_common.h