Give BASIC menus, dialogs and HUD labels over libakgl's UI helpers

Group K, and the first verbs to reach the akgl_ui subsystem 0.9.0 brought
in: MENU and GETMENU and RMENU, DIALOG, HUD and UISTYLE. A program that
wanted a title screen had to draw one out of CHAR and GETKEY, which is
what both breakout tutorials make a reader do.

The interesting part is the impedance mismatch. libakgl's UI is immediate
mode -- widgets are re-declared inside a frame bracket every frame and
clay borrows their text until the bracket closes -- and a BASIC program
says MENU 1, "START" on line 100 and expects it up on line 900, several
hundred frames later. So src/ui_akgl.c is retained on this side and
immediate on that one: the record's entry points are setters that copy
into akbasic_AkglUi, and akbasic_ui_akgl_render() replays the whole set
once a frame from the host's pump. No BASIC string, which lives in the
per-line value pool, is ever what clay is handed.

The shapes are borrowed rather than invented. MENU retires the way SOLID
does -- no entries retires one, no arguments retire them all. GETMENU
holds the step loop the way GETKEY does, so parking is not blocking: the
step still returns, the host keeps its frame rate, and the sprite, audio
and collision services keep running underneath because they run before
the blocking checks. RMENU(n,1) reads and clears the way BUMP() does.
Withdrawing the device or retiring the menu releases a holding GETMENU
with 0 rather than wedging the script, which is akbasic_input_service()'s
rule for a withdrawn keyboard.

One thing a program has to know, and docs/19-user-interface.md says it
twice: a menu that is up owns the cursor keys and Return. It has to, and
retiring it gives them back -- forget the MENU n before an INPUT and the
INPUT never sees the Return that ends it.

akbasic_runtime_set_ui() is its own function rather than a fifth argument
to akbasic_runtime_set_devices(), whose signature has twenty-eight call
sites in tests and documentation that are about something else.

deps/libakgl is not touched. akgl_UiAnchor has the four corners and dead
centre, so HUD offers exactly those five; TODO.md records what a
top-centre and bottom-centre would cost upstream, along with the three
other things this deliberately leaves out. No new error code either --
DEVICE, BOUNDS, SYNTAX and TYPE cover the group, and 520 stays free.

tools/screenshot.c had to learn that "needs a font" and "draws the text
grid" are two questions. They were one, and a UI figure came out black:
the text layer owns every pixel of the rows it covers and painted over
the widgets. The new ui=1 fence attribute asks for the first without the
second; MAINTENANCE.md documents it.

112/112 in both configurations, 112/112 under ASan and UBSan, coverage
94.1% against the 90% gate with src/runtime_ui.c at 99% of lines and
100% of functions, doxygen clean, and the four new figures byte-identical
on a re-render. TODO.md section 8's gate table was stale on several
counts besides these and is refreshed with measured numbers.

Co-Authored-By: Tachikoma (Claude Code Opus 5 1M) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwxGB6TdoVvZ11KQQME9cL

TODO.md

@@ -2483,6 +2483,31 @@ given. And `akgl_controller_poll_key()` survives alongside the keystroke form on
 and `GETKEY` still use it, because a script asking "was the up arrow pressed" wants a keycode
 and would get the empty string from the other one.
 
+**The UI group left four things on the floor, and none of them is filed.** Group K —
+`MENU`, `GETMENU`, `RMENU`, `DIALOG`, `HUD` and `UISTYLE`, over `akgl_ui` — deliberately
+covers libakgl's three widget helpers and nothing else. What a program cannot have, and
+what closing each would cost:
+
+1. **A top-centre or bottom-centre `HUD` anchor.** `akgl_UiAnchor` has the four corners
+   and dead centre, so `HUD` has exactly those five. Closing it upstream is two appended
+   enum values and two arms in `akgl_ui_label()`'s switch (`deps/libakgl/src/ui.c`), using
+   the `CLAY_ATTACH_POINT_CENTER_TOP` and `..._CENTER_BOTTOM` constants the dialog helper
+   in the same file already uses, with the horizontal inset dropped. Appending keeps 0
+   through 4 meaning what they mean, so it is additive. **Not filed, and not done here:
+   changing a dependency submodule is that repository's decision, not this one's.**
+2. **Per-widget styles.** `UISTYLE` sets one look shared by everything, because
+   `akgl_UiStyle` is per-call and threading an optional style number through three verbs'
+   argument shapes buys less than it costs. Nothing upstream is missing.
+3. **Anything of clay beyond the three helpers** — containers, scrolling, images in
+   panels, custom elements, hit-testing. Reachable from C against `akgl/ui.h` in the same
+   window; deliberately not reachable from BASIC.
+4. **A dialog the player can dismiss.** libakgl has no dismiss contract — a declarative
+   frame is the visibility flag — so `DIALOG` with no argument is the only way down.
+
+One cost carried rather than fixed: libakgl re-rasterizes every line of widget text every
+frame, which is its own open `TODO.md` item. A `HUD` rebuilt every frame is the expensive
+case. Recorded in `docs/19-user-interface.md` so a program author is not surprised by it.
+
 **`FILTER` is the one verb still refused**, and it is not filed as a gap because upstream said
 plainly what it would take: `akgl_audio_*` synthesises raw waveforms and mixes them, there is no
 filter stage to configure, and SDL3 supplies no primitive to build one from. Until an
@@ -2514,14 +2539,14 @@ requirement; two cases have diverged on purpose since, and
 
 | Gate | Result |
 |---|---|
-| `ctest` | 109/109 — 41 reference golden cases, 23 local ones, 40 unit tests, 1 known-failing, 3 embedding examples, and `docs_examples` |
-| `ctest` with `-DAKBASIC_WITH_AKGL=ON` | 109/109 headless, with `akgl_typing` skipping itself. The same set minus the three `no_device` cases the SDL driver contradicts, plus `akgl_backends`, `akgl_frontend`, `docs_screenshots` and `akgl_typing` — the last of which is the skip, and the `akgl_build` CI job is where it skips |
-| `docs_examples` | Every fenced block in `README.md`, `MAINTENANCE.md` and `docs/` executed and byte-compared: 55 programs, 9 transcripts, 63 output comparisons, 2 excerpts, 2 shell blocks and 8 figures in the default build. The C-snippet count reads 0 when the harness is run by hand without `--cflags-file`; CTest passes it. `MAINTENANCE.md` documents the fence-tag convention |
-| `docs_screenshots` | 8/8 figures re-rendered and byte-identical to the checked-in PNGs. AKGL build only — rendering a picture needs the SDL half |
+| `ctest` | 112/112 — 41 reference golden cases, 24 local ones, 41 unit tests, 1 known-failing, 3 embedding examples, and `docs_examples` |
+| `ctest` with `-DAKBASIC_WITH_AKGL=ON` | 112/112 headless, with `akgl_typing` skipping itself. The same set minus the four `no_device` cases the SDL driver contradicts, plus `akgl_backends`, `akgl_frontend`, `docs_screenshots` and `akgl_typing` — the last of which is the skip, and the `akgl_build` CI job is where it skips |
+| `docs_examples` | Every fenced block in `README.md`, `MAINTENANCE.md` and `docs/` executed and byte-compared: 71 programs, 9 transcripts, 79 output comparisons, 4 C snippets, 2 excerpts, 2 shell blocks and 19 figures in the default build. The C-snippet count reads 0 when the harness is run by hand without `--cflags-file`; CTest passes it. `MAINTENANCE.md` documents the fence-tag convention |
+| `docs_screenshots` | 19/19 figures re-rendered and byte-identical to the checked-in PNGs. AKGL build only — rendering a picture needs the SDL half |
 | Golden corpus | 41/41 byte-exact from `tests/reference/` — **and 41/41 again through the SDL binary**, which is most of what proves the frontend changes no output |
-| ASan + UBSan | 109/109 |
-| Line coverage | 94.9% (6767/7130) — above the 90% gate |
-| Function coverage | 98.5% (447/454) |
+| ASan + UBSan | 112/112 |
+| Line coverage | 94.1% (7227/7681) — above the 90% gate |
+| Function coverage | 97.9% (474/484) |
 | Warnings | none under `-Wall -Wextra` |
 | `doxygen Doxyfile` | clean |
 | Mutation (`src/symtab.c`) | 74.1%, against a gate of 65 — see `.gitea/workflows/ci.yaml` |