(lua) fixed monitoring mode breaks

it has been known for a while that we
did not properly escape user-definable
lua-strings, but due to the sparring
use-case (essentially running a hostile
script in monitoring mode) it has not
been a priority.
(build) started evicting / moving legacy