Loads Lua scripts into a hardened Luerl state.

The state is built on top of luerl:init/0 and then has every dangerous standard-library entry point cleared:

• os.execute, os.exit, os.getenv, os.remove, os.rename, os.tmpname
• io (the whole library)
• dofile, loadfile, load, loadstring
• package (the whole library) — replaced by an asobi_lua-controlled require/1 so scripts can still split logic across files

require/1 resolves names relative to the directory of the script that was loaded. Names must match [a-zA-Z_][a-zA-Z0-9_]*(\\.[a-zA-Z_][a-zA-Z0-9_]*)*, so dotted module paths work (require("bots.chaser") → <base>/bots/chaser.lua) but parent traversal (..), absolute paths, and arbitrary characters are rejected. Module results are cached in a private _ASOBI_LOADED table so repeat require calls return the same value.

math.random and math.sqrt are overridden to call into the Erlang rand and math modules respectively — Luerl's defaults are slower and less deterministic than the BEAM equivalents.

Use init_sandboxed/0 when you need a hardened state with no script attached (e.g. for evaluating a config.lua manifest); use new/1 to load a specific script and pin its base directory for require.