fix(lua): install game.* before script eval so handle_input closures capture it

[Taure]

Summary

• Lua function closures capture _ENV at compile time. asobi_lua_api:install/2 was called AFTER the script chunk was evaluated, so closures captured a _G without game.*.
• The bug was hidden in every callback except handle_input because everything else goes through bounded_eval (call/4). handle_input uses call/3 per ADR 0002, exposing the gap — _G.game was nil there, silently breaking game.notify, game.storage, game.broadcast, game.zone.spawn, game.spatial.*, and game.log from the most common server-auth callback.
• Fix: add asobi_lua_loader:new/3 with a PreInstall :: fun((St) -> St) hook that runs between sandbox setup and luerl:do(scriptCode, St). The four loader:new call sites in asobi_lua_world and asobi_lua_match now pass fun(St) -> asobi_lua_api:install(Ctx, St) end so game.* exists before any closure captures _ENV.

new/1 and new/2 are kept (delegate to new/3 with identity PreInstall) so existing callers are unaffected. A script's generate_world callback can now also use game.* (it couldn't before — same bug, just nobody had tried).

Test plan

• rebar3 fmt --check clean
• rebar3 xref clean
• rebar3 dialyzer clean
• ~/bin/elp eqwalize-all — no new errors vs main (baseline: 4 in loader, 1 in world)
• ~/bin/elp lint — no new warnings vs main
• rebar3 eunit — 209/209 pass (was 202; +7 regression tests)
• rebar3 ct — 8/8 pass
• New regression tests cover _G.game visibility from every world callback (init, join, leave, post_tick, zone_tick, handle_input) and every match callback (init, join, leave, handle_input, tick)
• asobi_lua_loader_tests adds a new/3 pre/no-pre control pair that probes a script function's view of a host-injected global
• Hot-reload path reasoned through (unchanged) — reload re-evaluates against the existing LuaSt which already has game.*, so new function definitions capture it

Follow-up (not in this PR)

• Pre-existing logger:error/warning function calls in src/lua/ should migrate to ?LOG_* macros per project convention. Every offending line is on unchanged source; bundling here would muddy the bisect.