I could detect this shit with Gandhi's flipflop for Christs sake.
If you really want to bypass cac's autorun, make it that the first lua ran is your lua script, do this by hooking it and forcing the first thing to be ran is your lua script. simple, none of this bullshit, I could detect it easy with hook.gettable...
-- Edit:
Also, if you even try to create/force sv_allowcslua you will be kicked for un-synced vars.