Features/poc macro

[nagisml]

@AgreeDK as discussed by PM here the POC for a filter LUA based macro solution
related to #938

[AgreeDK]

@nagisml
Thanks, I have some issues with my access, but I will review as soon as I can.

[AgreeDK]

@nagisml
Great work, thank you. All points from my mail are addressed, and catching the
hook-disabled xpcall handlers and __gc finalizers, plus sharing the budget
across coroutines, goes beyond what I'd found. 27 macro tests pass locally and
mypy is clean.

Two things before merging into beta:

1. Beta flag: please gate the Macros menu behind a flag in
   _RELEASE_DEFAULTS (utils/flags.py), so it can't slip into a stable
   release before [Epic] Macro & Scripting Support (Lua-based macro system) #938 step 4 is settled.
2. Known limitation, for [Epic] Macro & Scripting Support (Lua-based macro system) #938 step 4: the instruction hook only counts Lua
   instructions, not work inside C functions. For example, with
   instruction_limit=100_000, string.rep("a", 100):find(".-.-.-.-.-b")
   takes ~12 s, and at 200 characters it didn't finish within 30 s. The same
   will apply to the planned regex functions via Python's re. I don't think
   it can be fixed inside the sandbox. It belongs in the threading decision
   (worker thread keeps the GUI responsive but can't interrupt a running call;
   a subprocess can be killed). Not a blocker for a flagged beta merge, but
   worth a short note in the module docstring.

Meanwhile I'll run build.yml manually on this branch to check the packaged
builds on all four platforms (the go/no-go for #938 step 2).

[AgreeDK]

@nagisml

Step 2 — Lua packaging spike: go ✅

Tested with the build artifacts from PR #939 (build.yml run manually on a
temporary branch):

• ✅ Linux x86_64 AppImage
• ✅ Windows 10 (zip build, VM)
• ✅ macOS arm64 (M1)
• ⏳ macOS x86_64: built successfully in CI, not yet tested on hardware
• ⏳ Windows with Smart App Control: the unsigned opensak.exe from a one-off
  workflow build is blocked by SAC (confirmed via the CodeIntegrity log, not
  Lupa-related). Whether SAC accepts Lupa's lua54 extension will be checked
  once Lupa ships in a regular beta. The Microsoft Store build is signed by
  Microsoft and not affected.

Lupa (MIT) with Python 3.12 wheels for all four targets is confirmed as the
bridge.