fix: make Ctrl+C cancellation deterministic in the bridge (#4)

[srgg]

Summary

Fixes the hang where, after Ctrl+C with a device connected, an interactive
bridge script never stops (blim hangs forever at "Stopping script"). The
cooperative-cancellation count hook (LUA_MASKCOUNT) is not honored inside
LuaJIT-compiled traces, so an FFI-hot script loop spins forever and
L.DoString never returns.

Cancellation is made deterministic at the API boundary instead of relying on
the hook.

Changes

• blim.sleep raises on cancellation. On ctx.Done() it re-locks
  stateMutex (RaiseError walks the Lua stack — the SIGSEGV when a synchronous BLE read is called from inside a subscription callback #3 corruption class) and
  raises "script execution cancelled". This Go-side raise is not catchable by
  Lua pcall, so a polling loop — including blim.term.read_char, which sleeps
  on every step — aborts within one iteration.
• Bounded post-cancellation wait. A script with no cancellable boundary (a
  pure JIT/FFI loop) can never be stopped cooperatively. safeExecuteScript
  now gives up after scriptCancellationTimeout, dumps goroutines, and returns
  ErrScriptCancellationTimeout instead of hanging forever.
• Terminal restored on bridge exit. A script may switch the terminal to raw
  via blim.term.enable_raw; cancellation aborts it before disable_raw runs,
  leaving the shell stuck in raw mode. runBridge is split into a thin cobra
  wrapper and runBridgeCtx(ctx, ...); the latter snapshots the terminal on
  entry and restores it on exit (x/term), the way ssh does. The ctx split
  also lets the test drive cancellation without a process-global signal.

Tests

• TestSleepRaisesOnContextCancellation — blim.sleep aborts the script on
  cancellation (code after the sleep never runs).
• TestExecuteScript2_CancellationTimeout — an unstoppable script yields
  ErrScriptCancellationTimeout (checked via errors.Is), not an unbounded hang.
• TestBridgeRestoresTerminalOnExit — black-box: fake-tty stdin + mock device;
  a raw-mode script leaves the terminal restored after cancellation.
• Verified: whole module -race -count=1 clean, go vet + gofmt clean.

Follow-ups (out of scope, documented)

• Thread ctx into the other blocking BLE waits (characteristic.read/write,
  blim.subscribe's CCCD write) so cancellation returns immediately rather than
  after the op's own completion. Now a responsiveness nicety, not a hang —
  the bounded wait already caps the worst case.
• Pre-existing unsynchronized access to scriptExecutionCtx (not introduced
  here).

Fixes #4