feat(loader): per-eval heap cap to bound runaway Lua allocations

[Taure]

Summary

• Adds a `max_heap_size` spawn_opt to every Luerl eval the runtime performs (`do_with_timeout/3` and `call/4`).
• The eval process is killed by the VM if it allocates past the limit; the parent translates the DOWN reason into `{error, heap_exhausted}` so callers can distinguish heap-blow from timeout.
• Default is 5,000,000 words (~40MB), configurable via `asobi_lua.max_heap_words` in `sys.config`.
• Cap is per-eval, not on the gen_server itself — legitimate world-state growth is unaffected and a heap-blow only loses one tick rather than the entire match/world.
• Documented in `guides/self-hosting.md` under a new "Tuning knobs" section.

Test plan

• New `call_heap_bomb/0` eunit triggers and asserts `{error, heap_exhausted}`
• New `max_heap_env_override/0` eunit confirms env override is read per eval
• `rebar3 fmt --check`, `xref`, `dialyzer` clean
• `rebar3 eunit` passes (189 tests, +2 new)