Fix AKERR_MAX_ERR_VALUE to cover all AKERR_* codes

AKERR_MAX_ERR_VALUE was AKERR_LAST_ERRNO_VALUE + 15, but the highest defined
code, AKERR_BADEXC, is + 17 (AKERR_NOT_IMPLEMENTED is + 16). akerr_name_for_status
rejects any status above the max, so those codes could never have a registered
name and the AKERR_BADEXC registration in akerr_init was dead code -- a gap
found by mutation testing. Bump the max to + 17.

- err_maxval: new test asserting the reserved AKERR_* range exceeds the number
  of AKERR_* codes and that every code is individually indexable. Fails against
  the old + 15 value (verified), guarding against regression.
- err_error_names: now also checks AKERR_BADEXC's name, which the fix makes
  reachable.

Mutation score on src/error.c rises 71% -> 74%: the previously-dead BADEXC
registration and the name_for_status upper-bound check are now killable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/MUTATION.md

@@ -77,7 +77,7 @@ Re-run after adding tests and confirm the score went up.
 
 ## Current status
 
-`src/error.c` scores ~71% (the CI gate is set to 65% for headroom). The
+`src/error.c` scores ~74% (the CI gate is set to 65% for headroom). The
 remaining survivors are dominated by:
 
 * **Equivalent mutants** in `akerr_init`: deleting the `memset`/`NULL` setup of
@@ -90,11 +90,11 @@ remaining survivors are dominated by:
   test that captures a child's stderr and exit code, rather than the in-process
   capturing logger the other tests use.
 
-Findings worth noting (surfaced by mutation testing, not yet fixed):
+Findings surfaced by mutation testing:
 
-* `AKERR_MAX_ERR_VALUE` is `AKERR_LAST_ERRNO_VALUE + 15`, but `AKERR_NOT_IMPLEMENTED`
-  (+16) and `AKERR_BADEXC` (+17) exceed it. `akerr_name_for_status` rejects any
-  status `> AKERR_MAX_ERR_VALUE`, so those two codes can never store or return a
-  name — the `akerr_name_for_status(AKERR_BADEXC, ...)` call in `akerr_init` is
-  dead code (which is why deleting it survives). Bumping `AKERR_MAX_ERR_VALUE` to
-  `+ 17` would fix it.
+* **Fixed:** `AKERR_MAX_ERR_VALUE` was `AKERR_LAST_ERRNO_VALUE + 15`, below
+  `AKERR_NOT_IMPLEMENTED` (+16) and `AKERR_BADEXC` (+17). `akerr_name_for_status`
+  rejects any status `> AKERR_MAX_ERR_VALUE`, so those codes could never store or
+  return a name and the `akerr_name_for_status(AKERR_BADEXC, ...)` call in
+  `akerr_init` was dead code (which is why deleting it survived). The max is now
+  `+ 17`, and `tests/err_maxval.c` guards the invariant so it can't regress.