fix: resolve CI audit failures and missing Lua dependency

[zhoupengjie]

CI stops at the dependency audit, and the Node jobs lack the Lua interpreter required by the SV1 host test. Update vulnerable transitive dependencies and install Lua 5.4 in both Node matrix jobs so the host tests can run.

• Update fast-uri to 3.1.8, qs to 6.16.0, and hono to 4.13.8 in the lockfile; synchronize root bin metadata with package.json.
• Install Lua 5.4 before npm run check, also enabling the existing host tests that otherwise skip when Lua is absent.

Validation: clean dependency installation; production dependency audit reports zero vulnerabilities; local npm run check passes all 255 tests; required JavaScript and Lua 5.4 syntax checks pass; client-neutrality check passes after the workflow change. GitHub CI is required to pass before merging.