Add core + portable builds (core is the canonical crypto.lua)

[derek-miller]

Establishes the full/core split, inverted so the canonical crypto.lua is the core build:

• crypto.lua (canonical) — core build, bitn excluded (amalg -i bitn), expected on the Lua path. Composes with sibling libraries that share bitn without duplicating it.
• crypto-portable.lua — every dependency bundled, zero external deps, for single-file drop-in use.

CI verifies both; release publishes both; the post-build version smoke-test now covers both variants (addresses review note #2). Artifact name kept as crypto.lua (canonical), matching the sibling convention (addresses review note #1). Also fixes the x25519 usage example (generate_keypair() returns two values).

Part of inverting the naming convention across all lua-* libs so core builds are canonical and drivers compose them with shared deps vendored once.

[svc-finitelabs]

🦞 Reviewed the diff. Clean and well-scoped, mirrors the full/core split pattern from the sibling libs. LGTM.

Verified:

• x25519.generate_keypair() does return two values (private_key, public_key, x25519.lua:364-367), so the old README example using .private_key/.public_key on a table was genuinely broken. Good catch fixing it.
• make build now produces both crypto.lua and crypto-core.lua (the latter via -i bitn), version injected into both, and build.yml asserts both exist. release.yml publishes both.

Two minor heads-ups, your call:

1. Artifact rename: upload-artifact name changed from crypto.lua to crypto. If anything downstream (another workflow, a download-artifact step, external tooling) references the old artifact name, it'll break. Release assets are unaffected since those use file paths.
2. Version smoke-test coverage: the Makefile's post-build version() check only loads build.crypto, not build.crypto-core. The sed version injection into crypto-core.lua isn't smoke-tested, so a regression there would slip through CI. Low risk, but a one-liner asserting build.crypto-core loads + reports the right version would close the gap.

Not blocking either way. CI: Check passed, Lua matrix (5.1-5.4 + LuaJIT) still running. Not merging, leaving that to you.