Do not log sensitive credentials in Lua runtime logs (repo_url, NATS credentials)

In `@runtimes/lua/pkg/functions.lua` (M.sync_repo_and_reload, around lines 65-69) and `@runtimes/lua/pkg/state.lua` (around lines 137-143):

Sensitive information like git tokens (embedded in repo_url via credentials) and conf.settings.nats_url (NATS credentials) are logged. This can result in exposure of secrets in logs when fetching or connecting to NATS servers.

**Recommendation:**
- Sanitize repo_url before logging any URLs—strip or redact credentials from the value, mirroring the TS runtime's approach.
- Redact or omit credentials from NATS URLs before logging using conf.log—log only host/port or a sanitized/redacted value.

This prevents leaking sensitive information to log aggregation systems.

Start with runtimes/lua/pkg/functions.lua in M.sync_repo_and_reload around lines 65-69 and runtimes/lua/pkg/state.lua around lines 137-143. Compare the Lua logging with the TS runtime's sanitization approach, then verify that repository URLs and NATS URLs no longer expose credentials while retaining useful host or port information in logs.

Written by the indexing model from the issue text.