fix(ci): fix gcc 14+ incompatible-pointer-types error on Windows - #59

…igration

- Pin all GitHub Actions to immutable SHA digests (SLSA Level 3)
- Add Renovate configuration with corrected lux.toml regex and
  github-tags datasource (no native luarocks datasource exists)
- Map busted, luacov, luastatic to their canonical GitHub repos
- Add SBOM generation (anchore/sbom-action) for linux-x86_64 only
- Add build provenance attestation (actions/attest-build-provenance)
- Add update-release-notes job with attestation verification instructions
- Add luarocks-publish environment to publish workflow
- Fix indentation in publish.yml rockspec cleanup step
- Preserve paths-ignore in release-please workflow
- No permission changes to tests.yml (inherits repo default read)

…ensure-deps

The Windows build failed with 'ToolNotFound: failed to find tool gcc' because:
1. The MSYS2 setup-msys2 action only adds C:\msys64\usr\bin to GITHUB_PATH,
   not the UCRT64 subsystem bin directory. Native Windows programs (lx.exe,
   just.exe) couldn't find gcc.exe or lua.exe on the PATH.
2. The justfile's ensure-deps recipe didn't pass --lua-dir like other lx
   invocations, causing Lux to fail discovering Lua on non-standard paths.

Fixes:
- Add 'Add UCRT64 to PATH (Windows)' step after MSYS2 setup
- Pass --lua-dir to ensure-deps recipe in justfile

The Windows build failed with 'ToolNotFound: failed to find tool gcc' because
the justfile hardcoded a colon (':') as the PATH separator when prepending
the lux build dependencies bin directory. On Windows, this corrupted the
semicolon-separated PATH, causing MSYS2/Bash to lose access to /ucrt64/bin
and failing to find gcc.exe.

Fixes:
- Dynamically set path_sep to ';' on Windows and ':' otherwise in justfile

The Windows build failed with an incompatible pointer type error in libuv
because GCC 14+ makes -Wincompatible-pointer-types an error by default.

Fixes:
- Add -Wno-error=incompatible-pointer-types to CFLAGS for luv and luasystem