Fix two comments that misstate exit sites and NULL validity

Both found while auditing the pool for the cross-thread transfer guarantee.

AGENTS.md said the two exit() calls that bypass akerr_exit() are "both in
src/error.c". ENSURE_ERROR_READY's pool-exhaustion abort is in
include/akerror.tmpl.h. The count of abort sites is load-bearing -- it is
the argument against any API that could fail on pool exhaustion -- so
pointing at the wrong file makes it hard to check.

akerr_valid_error_address() returns 1 for NULL, which is right for VALID()
(NULL is how a function reports success) and a trap for anything reading it
as "is this a pool slot". Say so where the function is defined.

Comments only; no behavior change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Andrew Kesterson <andrew@aklabs.net>

src/error.c

@@ -129,6 +129,11 @@ akerr_ErrorContext *__akerr_copy_string(char *destination, int capacity,
  *
  * Takes no lock: the addresses of the pool slots are fixed for the life of the
  * process, and nothing here reads a slot's contents.
+ *
+ * NULL reads back as valid, because the caller is VALID() asking whether a
+ * function returned something it has no business returning, and NULL is how a
+ * function says it succeeded. Anything reading this as "is this a pool slot"
+ * must check for NULL itself.
  */
 int akerr_valid_error_address(akerr_ErrorContext *ptr)
 {