feat(sdk): add LLM round execution, script bindings, Lua runtime, and hybrid memory

[lIang70]

Summary

• sdk/llm: Add RunRound / StreamRound / RoundStream for structured LLM round execution with streaming tokens, tool calling, and OpenTelemetry span propagation. RoundStream.Close() is idempotent. Temperature changed to *float64 to distinguish zero from unset. RoundConfigFromMap now returns an error.
• sdk/script/bindings: Extract reusable bridge layer from scriptnode into a standalone package (board / expr / fs / llm / runtime / shell / stream). Shell bridge supports filepath.Base matching for allow-listed commands.
• sdk/script/luart: Pure-Go Lua 5.1 runtime (gopher-lua) with VM pooling. Close() is idempotent via sync.Once + atomic.Bool. Automatically discards tainted VMs after script errors to prevent global state leakage. pushGoValue supports integer map keys and logs warnings for unsupported key types.
• sdk/memory: Add HybridStore combining BM25 and vector similarity search with graceful fallback to BM25 on embed/vector errors. NewHybridStore(nil) panics with a clear message. Assembler refactored for hybrid search integration.
• sdk/speech: Add semantic endpoint detection, fix framesToLimit ceiling division, refactor pipeline, remove dead Pipeline.Abort() calls in session loop.
• sdk/graph/node: LLM node Temperature → *float64, ConfigFromMap returns error, buildMessages shallow-copies board messages to prevent mutation.

Review fixes included

Issues identified and fixed during code review:

1. RoundStream.Close() idempotent — nil-out inner after close to prevent double-close
2. RunRound span context correctly captured and propagated
3. luart.Runtime.Close() idempotent + acquire() closed guard returns ErrRuntimeClosed
4. luart VM discard after script error prevents global state leakage across pooled executions
5. pushGoValue supports map[int]T / map[uint]T; unsupported key types emit stderr warning
6. framesToLimit uses ceiling division to avoid premature silence threshold truncation
7. Shell bridge filepath.Base matching allows full-path commands (e.g. /usr/bin/echo matches echo)
8. NewHybridStore(nil) panic guard
9. HybridStore.Search emits telemetry warnings on embed/vector failure before BM25 fallback
10. buildMessages shallow-copies messages from board to prevent in-place mutation
11. Temperature → *float64 to distinguish explicit zero from unset
12. ConfigFromMap / RoundConfigFromMap return errors instead of silently ignoring bad input
13. Remove dead Pipeline.Abort() calls in session_loop.go

Test plan

• sdk/llm: RunRound normal/failure/callback/stream-error, StreamRound manual iteration, Close idempotency, RoundConfigFromMap valid/nil/zero (10 tests)
• sdk/script/luart: Close idempotent, Exec after close, VM discard no state leak, signal does not discard, int/uint key map (6 tests)
• sdk/speech/endpoint: ceiling division 150ms/100ms=2, single frame 50ms/100ms=1, zero-value fallback (4 tests)
• sdk/script/bindings: full-path command /usr/bin/echo allowed, full-path not in list blocked (2 tests)
• sdk/memory: NewHybridStore(nil) panics, embed error falls back to BM25, vector search error falls back to BM25 (3 tests)
• All modules pass go build ./... + go test ./... + go vet ./...