Add mutation testing, and split the release gates into their own workflow

Ports libakstdlib's mutation harness (the newest of the three) to scripts/
mutation_test.py, adds the namespaced `mutation` CMake target the sibling
libraries have, and splits CI in two.

.gitea/workflows/ci.yaml keeps the push path: suite, ASan+UBSan, coverage, and a
mutation run bounded to src/convert.c and src/symtab.c -- about four minutes,
scoring 77.8% against a gate of 65.

.gitea/workflows/release.yaml is new and manual (workflow_dispatch). It carries
the doxygen gate, moved out of ci.yaml, and a whole-tree mutation run: 3675
mutants and hours of runner time, which is a release cost rather than a
per-commit one. Both artifacts a release wants -- api-documentation and
mutation-report -- come out of it. Two optional inputs narrow the run or change
the threshold; they arrive through the environment rather than being
interpolated into the shell, because ${{ }} substitution happens before the
shell sees the line.

The harness paid for itself immediately, which is the point of it. Three real
gaps, each checked to be a genuine bug rather than an equivalent mutant:

  - errno was never asserted clear before a strtoll. Confirmed with a standalone
    probe that strtoll leaves a stale errno untouched on success, so without the
    `errno = 0` a valid conversion raises ERANGE.
  - Nothing exercised a maximum-length symbol-table key, so every MAX_KEY - 1
    off-by-one in a strncpy and its NUL terminator survived. The same hole exists
    for strings in src/value.c and is filed.
  - Nothing asserted a freshly initialised table was actually zeroed.

Closing the first two took the measured score from 73.1% to 77.8%.

I set the push-path threshold to 75 first, on an estimate. Measuring gave 73.1%
and the job would have failed on its first run -- the earlier per-file figure was
too high because the captured output had been truncated to its last lines and I
counted fewer survivors than there were. It is 65 now, and the gate was run as
written and confirmed to exit 0.

src/value.c is the file most worth mutating and is deliberately off the push
path: 368 mutants at ~11s each is about 70 minutes, because almost everything
links against it. A partial run over it found the same maximum-length-string
hole plus two genuinely equivalent mutants that only exist because of reference
defect section 6 item 5 -- adding both of the right operand's numeric fields
works only while the unused one is zero, so + and - are interchangeable there.
Recorded in TODO.md.

ctest 61/61; doxygen exits 0; both workflows' steps were executed locally, both
input paths included.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/symtab.c

@@ -4,6 +4,7 @@
  */
 
 #include <stdio.h>
+#include <string.h>
 
 #include <akbasic/error.h>
 #include <akbasic/symtab.h>
@@ -17,6 +18,7 @@ int main(void)
     void *value = NULL;
     int64_t ivalue = 0;
     char key[32];
+    char longkey[AKBASIC_SYMTAB_MAX_KEY + 2];
     int marker_a = 1;
     int marker_b = 2;
     int i = 0;
@@ -65,6 +67,63 @@ int main(void)
     TEST_REQUIRE_INT(TABLE.capacity, 16);
     TEST_REQUIRE_STATUS(akbasic_symtab_get(&TABLE, "V0#", NULL, NULL), AKERR_KEY);
 
+    /*
+     * Boundary keys. Mutation testing found that nothing exercised a key at the
+     * length limit, so every `AKBASIC_SYMTAB_MAX_KEY - 1` in the copy and its
+     * NUL terminator could be perturbed to `+ 1` or `- 0` and survive. A key one
+     * character under the limit must round-trip exactly; one *at* the limit must
+     * be refused rather than silently truncated.
+     */
+    TEST_REQUIRE_OK(akbasic_symtab_clear(&TABLE));
+    memset(longkey, 'K', AKBASIC_SYMTAB_MAX_KEY - 1);
+    longkey[AKBASIC_SYMTAB_MAX_KEY - 1] = '\0';
+    TEST_REQUIRE_OK(akbasic_symtab_set(&TABLE, longkey, &marker_a, 7));
+    TEST_REQUIRE_OK(akbasic_symtab_get(&TABLE, longkey, &value, &ivalue));
+    TEST_REQUIRE(value == &marker_a, "a maximum-length key must round-trip");
+    TEST_REQUIRE_INT(ivalue, 7);
+    TEST_REQUIRE_INT(strlen(TABLE.slots[0].key) + strlen(TABLE.slots[1].key) +
+		     strlen(TABLE.slots[2].key) + strlen(TABLE.slots[3].key) +
+		     strlen(TABLE.slots[4].key) + strlen(TABLE.slots[5].key) +
+		     strlen(TABLE.slots[6].key) + strlen(TABLE.slots[7].key) +
+		     strlen(TABLE.slots[8].key) + strlen(TABLE.slots[9].key) +
+		     strlen(TABLE.slots[10].key) + strlen(TABLE.slots[11].key) +
+		     strlen(TABLE.slots[12].key) + strlen(TABLE.slots[13].key) +
+		     strlen(TABLE.slots[14].key) + strlen(TABLE.slots[15].key),
+		     AKBASIC_SYMTAB_MAX_KEY - 1);
+
+    memset(longkey, 'K', AKBASIC_SYMTAB_MAX_KEY);
+    longkey[AKBASIC_SYMTAB_MAX_KEY] = '\0';
+    TEST_REQUIRE_STATUS(akbasic_symtab_set(&TABLE, longkey, NULL, 0), AKBASIC_ERR_BOUNDS);
+    TEST_REQUIRE_STATUS(akbasic_symtab_get(&TABLE, longkey, NULL, NULL), AKERR_KEY);
+
+    /*
+     * A freshly initialised table is empty and its slots are clear. Mutation
+     * found that deleting the memset or the count reset in init() survived,
+     * because every other assertion here goes through set() first.
+     */
+    TEST_REQUIRE_OK(akbasic_symtab_init(&TABLE, 16));
+    TEST_REQUIRE_INT(TABLE.count, 0);
+    for ( i = 0; i < 16; i++ ) {
+	TEST_REQUIRE(!TABLE.slots[i].used, "slot %d should be unused after init", i);
+	TEST_REQUIRE(TABLE.slots[i].key[0] == '\0', "slot %d key should be clear", i);
+	TEST_REQUIRE(TABLE.slots[i].value == NULL, "slot %d value should be NULL", i);
+	TEST_REQUIRE_INT(TABLE.slots[i].ivalue, 0);
+    }
+
+    /*
+     * Probing must start where the hash says. Mutation found that seeding the
+     * probe index or the loop counter to 1, or dropping the hash call entirely,
+     * survived -- a table that ignores its hash still works, just slowly. Assert
+     * placement instead: with capacity 1 there is exactly one slot, so a second
+     * distinct key has nowhere to go.
+     */
+    TEST_REQUIRE_OK(akbasic_symtab_init(&TABLE, 1));
+    TEST_REQUIRE_OK(akbasic_symtab_set(&TABLE, "ONLY#", NULL, 1));
+    TEST_REQUIRE(TABLE.slots[0].used, "the single slot must be the one used");
+    TEST_REQUIRE_STATUS(akbasic_symtab_set(&TABLE, "OTHER#", NULL, 2), AKBASIC_ERR_BOUNDS);
+    TEST_REQUIRE_OK(akbasic_symtab_get(&TABLE, "ONLY#", NULL, &ivalue));
+    TEST_REQUIRE_INT(ivalue, 1);
+
     /* Argument validation. */
     TEST_REQUIRE_STATUS(akbasic_symtab_init(NULL, 16), AKERR_NULLPOINTER);
     TEST_REQUIRE_STATUS(akbasic_symtab_init(&TABLE, 0), AKBASIC_ERR_BOUNDS);