fix(capi.lua): make Lua dependency identity exact

[Sunrisepeak]

Summary

• keep the immutable mcpplibs.capi.lua@0.0.3 release payload unchanged
• replace its legacy upstream Form A manifest with an index-side Form B bridge
• declare the real C dependency as exact compat.lua@5.4.7
• add a local-index consumer that imports the module and executes Lua code

Why

The upstream 0.0.3 manifest predates exact package selectors and declares bare lua. Under the exact identity contract, that means (mcpplibs, lua), while the C library is actually (compat, lua). This blocks xlings and other consumers once mcpp stops cross-namespace fallback.

Verification

• mcpp 2026.8.8.2 xpkg parse across all descriptors
• Lua syntax, mirror URL, package-name, cross-package-reference, and platform-version parity gates
• PR mcpp local-index parse: 2 sources, 1 module, 1 target, exact compat.lua dependency
• mcpp test -p tests/examples/capi-lua --no-cache: 1 passed, 0 failed
• generated lock evidence records compat.lua and mcpplibs.capi.lua with exact namespaces

Fixes #196

[Sunrisepeak]

Final validation checkpoint

All required checks are green (10/10): build, lint, select, timings, mirror reachability, graphics side-effect isolation, and workspace consumers on Linux default, Linux LLVM, macOS, and Windows.

The immutable mcpplibs.capi.lua@0.0.3 payload remains unchanged; only the index-side Form B bridge and executable exact-identity regression are added. The branch diff contains no machine-local paths or user data.