Care how hack-ish it is?
I wouldn't expect Source to let one run external code. That doesn't mean it can't be done, just that it would be an external module as you mentioned, or some exploit not corrected.
That being said, there's an easy hack that would work.
Run a looping python script.
Have it sleep 5-10 seconds between running. (Or longer, if you don't mind longer delay)
Have that script look for a text file containing input commands.
Have Lua output whatever commands you want to a .txt
The script, after running whatever is in that text, deletes it.
Process loops back again.
It's not pretty. But until you find the pretty answer, it would work.