[siracozmen01]

Problem

The determinism workflow downloaded Lua 5.4.9's source from www.lua.org in each of its four jobs, every run, and checked nothing about what it got. Twice in a row on main (runs 42003344172 and 42059792394), the Windows job failed because lua.org did not answer. A tarball that was not the one meant would have been built and compared without anyone noticing.

Change

.github/workflows/determinism.yml, the same way the organization's cpp.yml keeps its downloads:

• LUA_VERSION and LUA_SHA256 at the top of the workflow pin Lua's source. The SHA-256 is the one lua.org publishes beside the file in https://www.lua.org/ftp/, and the tarball downloaded from there hashes to it.
• Each job restores .cache/lua from an actions/cache keyed by the runner's OS and the pin. It downloads from lua.org only when the kept file is missing or does not match, and then holds the file to the pin before anything is built. A file that does not match fails the job with that said.
• The cache is saved only on a miss, only from main, and never from a pull request.
• The Windows job takes the checked tarball from the same step instead of its own Invoke-WebRequest. Paths name the version through LUA_VERSION.

Once main has run it once, an outage at lua.org no longer fails the job.

Verification

• The fetch step, run locally: with the kept file it copies it without asking lua.org; with the kept file corrupted it downloads again and the result matches the pin; with a wrong pin it downloads, then fails with the error. The tarball downloaded twice from lua.org has SHA-256 2335b6c5...fb8e6 both times.
• zizmor --offline reports nothing on the new workflow, as on the old.
• This branch's push ran the workflow (run 42473468701): all four jobs and the table passed, each taking Lua's source through the new step. It saved nothing, since it is not main.

Closes #259