chore(perf): cache compiled Lua scripts across executions

[crenshaw-dev]

Summary

• Cache compiled FunctionProto objects keyed by raw script source so health checks, resource actions, and discovery scripts skip re-parsing on every invocation.
• Use a bounded LRU (1024 entries, github.com/golang/groupcache/lru, same as util/glob) keyed by script content; edits to argocd-cm customizations are a new key with no explicit invalidation.
• Replace DoString with loadCompiledFunction → PCall; compilation errors are not cached.
• Applies to all Lua execution paths through runLuaWithResourceActionParameters.

Related to #28255. Independent of #28275 and #28277.

Benchmark

go test ./util/lua/... -run='^$' -bench='BenchmarkExecuteHealthLuaScriptCache' -benchmem -count=5

Uses the bundled argoproj.io/Rollout health script (~5 KB) with testdata/canary/healthy_executedAllSteps.yaml (Apple M3 Max, darwin/arm64):

Sub-benchmark	ns/op	B/op	allocs/op
cacheOff	~241,500	~422,450	4,025
cacheOn	~51,500	~168,430	800

Roughly ~4.7× faster and ~3,225 fewer allocations per health evaluation on this representative script.

Test plan

• go test ./util/lua/...
• TestCompiledScriptCache_ContentAddressed — same source returns same proto; script edits are distinct keys
• TestCompiledScriptCache_BoundedEviction — LRU cap enforced
• TestCompiledScriptCache_OnOffParity — cache does not change health output

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Title of the PR
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

Made with Cursor

[bunnyshell]

✅ Preview Environment deployed on Bunnyshell

Component	Endpoints
argocd	https://argocd-up3bcu.bunnyenv.com/
argocd-ttyd	https://argocd-web-cli-up3bcu.bunnyenv.com/

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🔴 /bns:stop to stop the environment
• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@f6ade14). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff            @@
##             master   #28278   +/-   ##
=========================================
  Coverage          ?   64.83%           
=========================================
  Files             ?      425           
  Lines             ?    59120           
  Branches          ?        0           
=========================================
  Hits              ?    38328           
  Misses            ?    17234           
  Partials          ?     3558           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.