Stop a scalar created inside a scope costing value-pool slots

A scalar now lives in the variable record (`akbasic_Variable::inlinevalue`)
rather than drawing from the value pool, so a `GOSUB` local, a `FOR` counter and
a `DEF` parameter cost nothing at all.

The pool is a bump allocator with no free, and its comment justified that with
"nothing in BASIC destroys a variable". Scope exit does: it marks the variable
slot unused, `new_variable()` memsets the slot it hands back -- clearing
`values` -- and `variable_init()` therefore took *fresh* slots for a variable
whose old ones were still counted. Every scope that created a local leaked, with
no diagnostic until the pool ran dry on whichever line happened to be unlucky.

Six thousand `GOSUB`s creating one local used to die on the 4091st at `LOC# = 1`
with "Array of 1 elements does not fit in the 0 remaining value slots". They now
run. A `DEF` called eight thousand times used to die between the four and five
thousandth -- the leaking slot was the call scope's parameter, which is a scalar
-- and both forms now run. A game creating one name per tick was dead in half a
minute; the Breakout in examples/ was, after twenty-five seconds.

**A `@` name is the one exclusion, and it is the whole of it.** A structure or a
pointer to one keeps pool storage, because a pointer into a record outlives the
scope that DIMmed it -- docs/16-structures.md says nothing is reclaimed and
`prev_environment()` relies on it. The name suffix is the right test rather than
`structtype`, which the DIM path sets *after* calling `variable_init()`. A local
array therefore still leaks, deliberately, and is now the narrow rule the
tutorial teaches.

`SWAP` needed the other half: it copies whole variable records, so the `values`
pointer that came over named the other variable's inline slot -- which by then
held this variable's own old value -- and SWAP silently did nothing. Caught by
tests/language/housekeeping/verbs.bas, which is the golden corpus earning its
keep.

tests/value_pool.c is the new coverage. It asserts the mechanism as well as the
consequence: a later change that moved arrays inline too would pass every
behavioural case and quietly break the pointer guarantee. The sharpest case
takes the pool's whole 4096 slots in four arrays after two hundred scope
entries, so one leaked slot has nowhere to go.

Chapter 17 Step 3 taught "declare every name at the top" and no longer needs to.
It now teaches what is still true -- a name first seen inside a subroutine dies
at RETURN, so a routine cannot answer its caller through one -- and its
demonstration is the array case, which still fails.

TODO.md section 6 item 30 and section 9 item 1, both struck.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/user_functions.c

@@ -22,15 +22,31 @@
 #include "harness.h"
 #include "testutil.h"
 
-/** @brief Run a program to completion, bounded so a hang fails rather than waits. */
-static akerr_ErrorContext AKERR_NOIGNORE *run_program(const char *source)
+/** @brief Run a program to completion under an explicit step budget. */
+static akerr_ErrorContext AKERR_NOIGNORE *run_program_bounded(const char *source, int64_t steps)
 {
     PREPARE_ERROR(errctx);
 
     PASS(errctx, harness_start(NULL));
     PASS(errctx, akbasic_runtime_load(&HARNESS_RUNTIME, source));
     PASS(errctx, akbasic_runtime_start(&HARNESS_RUNTIME, AKBASIC_MODE_RUN));
-    PASS(errctx, akbasic_runtime_run(&HARNESS_RUNTIME, 20000));
+    PASS(errctx, akbasic_runtime_run(&HARNESS_RUNTIME, steps));
+    SUCCEED_RETURN(errctx);
+}
+
+/**
+ * @brief Run a program to completion, bounded so a hang fails rather than waits.
+ *
+ * 20,000 steps, which is generous for every case here except the two that call a
+ * function eight thousand times. Those name their own budget rather than raising
+ * this one, because a bound loose enough for them would stop the recursion case
+ * from failing quickly.
+ */
+static akerr_ErrorContext AKERR_NOIGNORE *run_program(const char *source)
+{
+    PREPARE_ERROR(errctx);
+
+    PASS(errctx, run_program_bounded(source, 20000));
     SUCCEED_RETURN(errctx);
 }
 
@@ -232,6 +248,42 @@ static void test_call_scopes_are_reclaimed(void)
     harness_stop();
 }
 
+/**
+ * @brief Eight thousand calls, which used to be about four thousand too many.
+ *
+ * The *variable* slot came back (the test above); the value slots behind the
+ * parameter did not. A `DEF` cost one pool slot per call and died between the
+ * four and five thousandth with "Array of 1 elements does not fit in the 0
+ * remaining value slots" -- so a game calling one function per frame at thirty
+ * frames a second got a little over two minutes, and the message named neither
+ * the function nor the reason.
+ *
+ * TODO.md section 9 item 1. Both forms are here because both leaked: the
+ * comparison that isolated it originally was that a `GOSUB` doing the same work
+ * ran eight thousand times without complaint.
+ */
+static void test_calls_do_not_leak_value_slots(void)
+{
+    TEST_REQUIRE_OK(run_program_bounded("10 DEF ADDIT(N#)\n"
+					"20   RETURN N# + 1\n"
+					"30 R# = 0\n"
+					"40 FOR I# = 1 TO 8000\n"
+					"50   R# = ADDIT(I#)\n"
+					"60 NEXT I#\n"
+					"70 PRINT \"OK \" + R#\n", 1000000));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "OK 8001\n");
+    harness_stop();
+
+    TEST_REQUIRE_OK(run_program_bounded("10 DEF SQR1(X#) = X# * X#\n"
+					"20 R# = 0\n"
+					"30 FOR I# = 1 TO 8000\n"
+					"40   R# = SQR1(I#)\n"
+					"50 NEXT I#\n"
+					"60 PRINT \"OK \" + R#\n", 1000000));
+    TEST_REQUIRE_STR(HARNESS_OUTPUT, "OK 64000000\n");
+    harness_stop();
+}
+
 int main(void)
 {
     TEST_REQUIRE_OK(akbasic_error_register());
@@ -244,6 +296,7 @@ int main(void)
     test_structure_parameters();
     test_structure_parameter_types_are_checked();
     test_call_scopes_are_reclaimed();
+    test_calls_do_not_leak_value_slots();
 
     return akbasic_test_failures;
 }