chore: vendor Lua + munit with licenses and provenance

thirdparty/munit/UPSTREAM

@@ -0,0 +1,18 @@
+name: munit
+version: 0.2.0
+source: https://github.com/nemequ/munit
+license: MIT (COPYING in upstream repo; vendored verbatim as LICENSE)
+
+pinned-commit: ad67a3a2ca6b0e106c9c8d515772359eadcefad6
+  git tag v0.2.0 (peeled commit) on https://github.com/nemequ/munit.
+
+vendored-files: munit.c, munit.h, LICENSE (verbatim upstream COPYING).
+  munit is a 2-file framework (munit.c + munit.h), not literally
+  single-header; both files are required to compile and link.
+
+local-patch (munit.c line 269): the upstream `ATOMIC_VAR_INIT(x)` macro was
+  removed in C23 (deprecated C17). Replaced with `(x)` — the same fallback
+  upstream already uses for the non-atomic and clang paths. C23 allows
+  `static _Atomic uint32_t x = 42;` directly, so this is semantically
+  identical under C23. This is the ONLY deviation from the pinned SHA; it is
+  required for the project's mandated `-std=c23` build.