lua-ml allows "local" in the global scope, but unfortunately lua-ml correctly interprets the Lua 2.5 manual where "local" binds to blocks, not chunks. (Later versions of Lua state that chunks are blocks.) So no statements in the global chunk can use the "local" binding unless you introduce a block.
In other words:
local module M = {}
function M.somefunc() print("somefunc") end
M.somefunc()
does not always work (but now it works in the mlfront-shell lua REPL? why?)
Regardless, put a linter in the VALUESCAN phase (ie. analysis) ... setting a global variable must cause an error. Just read the chunks and any Luaast.Assign are easy to detect.