The host's clock, zone texts, game clock and error-handler slot leave _G, and the getters over them answer the reference's shapes (#580)

The host's state leaves `_G`: the eleven `__benilla_*` globals, which any addon could read and overwrite, move into the host's model (and, for the error handler, the Lua registry, as the reference keeps it), and the getters over them are Rust bindings answering the reference's shapes.

- `GetTime` returns one number (`0x515ea0`), and `GetGameTime` returns hour then minute (`0x515ee0`). The tick advances the model clock, and every cooldown and buff reader reads it.
- `GetZoneText`, `GetRealZoneText`, `GetSubZoneText` and `GetMinimapZoneText` always answer a string, `""` when unset (`0x48a0a0`-`0x48a100`). `GetZonePVPInfo` answers three values (`0x48d540`).
- `seterrorhandler`/`geterrorhandler` work over a registry slot that starts empty, as the reference's does (`0x7039e0`, `0x702950`, `0x702900`). A non-function raises `Usage: seterrorhandler(errfunc)`. The engine dispatches caught errors through the slot, not through the global (`0x703b40`). The stock `BasicControls.xml` installs `_ERRORMESSAGE` before any addon, so play is unchanged.
- The engine's surface allowlist now holds only `_G`. `scripts/api-coverage.sh` no longer excuses `__` names.

Verified:
- New tests show each of the eleven names absent from `_G` and that writing it changes nothing. On main, `__benilla_now = 0` rewound `GetTime` and every buff and cooldown.
- The getter shapes and the error-handler slot are pinned. The surface gate fails when a name is re-added.
- `scripts/gates.sh` and `scripts/smoke.sh` are green.
- A live run read the clock, zone texts, PvP info and game time, then showed that writing the old names changes nothing.

Built on macOS; no platform seam touched.

Fixes #576

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

scripts/api-coverage.sh

@@ -50,10 +50,9 @@ awk -F'\t' -v ref="$REF" -v show_missing="$show_missing" -v show_beyond="$show_b
     if (o == "engine" || o == "lua") have++
     else if (o == "framexml") transcribable[$1] = 1
     else {
-      # Categorize the superset. Only the last bucket is an API-target question; the first two are
-      # benilla being benilla, and the third is our Lua runtime being 5.1 where 1.12 is 5.0.
+      # Categorize the superset. Only the last bucket is an API-target question; the first is
+      # benilla being benilla, and the second is our Lua runtime being 5.1 where 1.12 is 5.0.
       if ($1 ~ /^Benilla/)                                    bridge[$1] = 1
-      else if ($1 ~ /^__/)                                    internal[$1] = 1
       else if ($1 ~ /^(_G|_VERSION|coroutine|print|select)$/)  lua51[$1] = 1
       else                                                     api[$1] = 1
     }
@@ -78,7 +77,6 @@ awk -F'\t' -v ref="$REF" -v show_missing="$show_missing" -v show_beyond="$show_b
 
     printf "\nbeyond 1.12, by kind — every one of these is a deliberate exception or a bug:\n"
     printf "  %3d  benilla host bridge      Benilla*, called only by our own FrameXML\n", length(bridge)
-    printf "  %3d  VM internals             __benilla_*, pushed by the tick\n", length(internal)
     printf "  %3d  Lua 5.1 past 1.12'\''s 5.0  ", length(lua51); dump(lua51, "")
     printf "  %3d  WoW API past 1.12        the phase-5 list\n", length(api)
     printf "  %3d  ours in Rust that 1.12 defines in FrameXML\n", length(transcribable)