fix: reject redis pub/sub commands, auto-seed math.random, flua CLI exit code

[esrrhs]

Background

Three issues from the FakeLua Phase 16 integration report (docs/fakelua-bugs-phase16.md, found 2026-10-11 against dafdac7 while wiring event/sqlite/http/net.udp/crypto/random/utf8/url/csv/redis into a game server demo). The report's Bug 1 (math-specialization entry guard aborting processes on non-numeric arguments) is addressed independently by #30; this PR fixes Bugs 2/3/4.

Bug 2 — redis SUBSCRIBE use-after-free (safety)

conn:command() is a one-shot RPC channel: each command allocates a CmdOp, queues it, and passes its raw pointer to hiredis as privdata. For SUBSCRIBE, hiredis invokes the same callback for every pushed message. After the subscribe ack is dispatched in Tick(), the CmdOp is popped and destroyed — so the second push writes op->done = true / clones a reply through a dangling pointer: heap corruption, guaranteed crash, and messages never reach Lua.

Full Pub/Sub requires a dedicated long-lived subscription context (a larger feature needing a live server to validate). This PR applies the report's minimum safe fix:

• SUBSCRIBE/PSUBSCRIBE/UNSUBSCRIBE/PUNSUBSCRIBE (case-insensitive) are rejected in RedisConnection::Command() before the readiness check, with a clear pcall-catchable error — no UAF reachable, error even before connect completes.
• Both src/native/README*.md document that Pub/Sub is unsupported and show the polling workaround (LPUSH+LRANGE, ZADD+ZREVRANGE).
• New server-less test test_redis.subscribe_rejected runs on TCC/GCC/INTERP via CallAll.

Bug 3 — math.random not auto-seeded

std::rand() defaults to seed 1, so without an explicit math.randomseed every process restart produced the identical sequence (819122 956267 764553). The math library now auto-seeds once per process on first state init using time + std::random_device + stack-address entropy (same-second launches still differ), matching Lua 5.4's automatic seeding. Explicit math.randomseed(x) continues to override; all existing math tests seed explicitly, and the three callers that don't only assert ranges/boundaries. Verified across three separate flua processes and three backends.

Bug 4 — uncaught errors abort with SIGABRT

An uncaught FakeluaException propagated to libc++abi and terminated the CLI with exit code 134 instead of the Lua-conventional exit 1. cmd/main.cpp now wraps compile/run in try/catch (std::exception), prints flua: <msg> to stderr and returns 1. Verified for runtime errors on all three backends and for compile-time syntax errors.

Tests

• New test_redis.subscribe_rejected (all backends, no redis-server needed).
• math suite 95/95, redis non-integration 7/7.
• Full suite: only the 8 test_mysql.integration_* tests fail (require a live MySQL server — pre-existing environment baseline); zero redis failures.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.00%. Comparing base (2c89572) to head (eecdcfd).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #31      +/-   ##
==========================================
+ Coverage   87.99%   88.00%   +0.01%     
==========================================
  Files         124      124              
  Lines       25388    25406      +18     
==========================================
+ Hits        22339    22358      +19     
+ Misses       3049     3048       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.