Guard host userdata identity against stale-reference reuse

[rbroderi]

Add a regression guard for the failure mode reported in scoder/lupa#294.

Lupa's Lua 5.5 bug came from reusing a cached host-object reference slot before the old Lua userdata wrapper had actually been collected, allowing a stale wrapper to resolve to a different live Python object.

LuaPyre currently avoids that mechanism entirely: opaque host userdata is represented by the Python object reference itself rather than a recyclable registry handle. This PR makes that an explicit invariant and locks it in with stress coverage.

Changes:

• add a 20,000-iteration host userdata round-trip test with temporary Lua table creation and repeated forced collection
• verify three distinct host objects remain distinct Lua table keys across GC cycles
• document in LuaRuntime._to_lua() that reusable host-reference registries must use identity/generation validation on reuse and finalization

Validation:

• branch CI passes on Python 3.13 and 3.14
• full existing suite remains green
• Lupa Lua 5.5 backend verification remains green

Reference:

• Python userdata identity can get mixed up in Lua 5.5 scoder/lupa#294
• proposed upstream fix: GH#294: Fix a timing issue with the new garbage collector in Lua 5.5. scoder/lupa#296