Report the failures libakstdlib's wrappers were already catching

Updates deps/libakstdlib to 669b2b3. That commit is a TODO entry rather
than new code, so the interesting part is what libakgl was not yet
calling: it links libakstdlib and uses ten of its wrappers while calling
the raw libc function at a good many more sites. Four of those were
carrying a real defect.

akgl_game_save checked every write and threw away the close. Every write
goes through aksl_fwrite, and for a record this size all of them land in
stdio's buffer -- nothing reaches the device until the close flushes it,
so a full disk, an exceeded quota or an NFS server going away is
reported only there. The function returned success over a savegame that
was never written. aksl_fclose surfaces it. tests/game.c reaches the
path through /dev/full, which accepts writes and fails at the flush;
against the unfixed code the test reports "expected a failure, got
success" with ENOSPC.

The close has to drop the FILE * before the status is examined, because
fclose(3) disassociates the stream either way and CLEANUP would close it
again. Written the other way round it aborted in glibc with "double free
detected in tcache" the first time a close actually failed, which is how
that ordering was found.

akgl_game_load's end-of-file check used fgetc(3), which spells "end of
file" and "the read failed" with the same EOF -- a disk error there read
as a clean end and passed the check it was meant to fail. aksl_fgetc
tells them apart. Extracted to require_at_eof, because inverting the
sense of a call inline needs a nested ATTEMPT whose break binds to the
wrong switch.

Two snprintf sites were truncating under a silenced
-Wformat-truncation. The compiler was right about both. The tileset one
handed the shortened path to IMG_LoadTexture, so a length error was
reported as a missing file, with SDL naming a path the caller never
wrote. Both use aksl_snprintf now and the suppression is gone; nothing
in the tree uses those macros any more. tests/tilemap.c covers the join,
and against the unfixed code it gets AKGL_ERR_SDL where it wants
AKERR_OUTOFBOUNDS.

The two src/game.c strncpy sites the fixed-width copy sweep missed --
the savegame name field and the libversion stamp -- use aksl_strncpy and
sizeof rather than a repeated 32.

Also makes tests/physics_sim.c deterministic. It placed gravity_time at
"now - dt" and let the real clock supply the step, so a machine busy
enough to deschedule the process between that store and the
SDL_GetTicksNS() inside simulate got a longer step. It went red once,
under a parallel ctest. It now sets max_timestep to the step it wants
and gravity_time to zero, so the bound supplies the step and the
scheduler cannot reach it.

TODO.md records what is deliberately not adopted: the pure-arithmetic
wrappers, which can only fail on NULL and which the tree already spells
two ways, and the collections, which the registries do not want because
SDL owns the property-set lifetime. AGENTS.md has the rule and the
fclose ordering trap.

26/26 ctest, memcheck clean, warning-clean at -Wall -Werror.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8T5FAYXE8HEJqFLCYwNNc

include/akgl/error.h

@@ -27,10 +27,18 @@
 #error "libakgl requires libakerror >= 1.0.0: the akerror.h on the include path predates the status registry. Rebuild and reinstall libakerror."
 #endif
 
-// This macro is used to silence warnings on string concatenation operations that may fail.
-// e.g., combining two element of PATH_MAX into a string buffer of AKGL_STRING_MAX_LENGTH.
-// We have to draw a line in the sand somewhere or we will just let our buffers grow forever
-// to keep the compiler happy.
+// Silences -Wformat-truncation on a string concatenation that genuinely may not
+// fit -- e.g. joining two PATH_MAX strings into one AKGL_MAX_STRING_LENGTH
+// buffer. The line has to be drawn somewhere or the buffers grow forever to
+// keep the compiler happy.
+//
+// **Nothing in libakgl uses these any more.** Both sites -- the path join in
+// akgl_path_relative and the tileset image join in
+// akgl_tilemap_load_layer_image -- now go through aksl_snprintf, which raises
+// AKERR_OUTOFBOUNDS on truncation instead. That is the better answer: the
+// compiler was right both times, and silencing it left the truncation
+// happening and unreported. Kept because they are public and a consumer may
+// have them; see TODO.md.
 #define DISABLE_GCC_WARNING_FORMAT_TRUNCATION			\
     _Pragma("GCC diagnostic push")				\
     _Pragma("GCC diagnostic ignored \"-Wformat-truncation\"")

include/akgl/game.h

@@ -208,6 +208,12 @@ void akgl_game_update_fps(void);
  * @throws ENOENT, EACCES Or whatever else `fopen(3)` reports, with the path in
  *         the message.
  * @throws AKERR_IO On a stream error or a short write.
+ * @throws ENOSPC, EDQUOT Or whatever else the close reports. A record this size
+ *         fits entirely in stdio's buffer, so nothing reaches the device until
+ *         the close flushes it and that is the only place a full disk, an
+ *         exceeded quota or a server going away can be seen. The close is
+ *         checked; success here means the bytes are on the device.
+ * @throws AKERR_OUTOFBOUNDS If a registered name does not fit its field.
  *
  * @note This is a partial implementation: the name tables are written but the
  *       objects themselves are not, so the file is not yet enough to restore a
@@ -236,6 +242,11 @@ akerr_ErrorContext AKERR_NOIGNORE *akgl_game_save(char *fpath);
  *         the running game, is not valid semver.
  * @throws AKERR_API If the save file is from a different library version, game
  *         version, game name, or game URI.
+ * @throws AKERR_IO If anything remains in the file after the four name tables.
+ *         The tables carry no length prefix and end at a zeroed sentinel, so a
+ *         reader whose field widths disagree with the writer's stops early
+ *         inside an entry and would otherwise report success with silently
+ *         wrong maps. Trailing data is the symptom of that disagreement.
  *
  * @note Like akgl_game_save, this is partial: it rebuilds the pointer maps but
  *       does not yet read back any objects. The four `SDL_CreateProperties`

include/akgl/tilemap.h

@@ -601,10 +601,10 @@ akerr_ErrorContext AKERR_NOIGNORE *akgl_tilemap_load_layer_object_actor(akgl_Til
  * @throws AKGL_ERR_SDL If the image cannot be loaded. The message carries
  *         `SDL_GetError()`.
  * @throws AKGL_ERR_HEAP If the string pool is exhausted.
- *
- * @note The joined path is truncated at
- *       #AKGL_TILEMAP_MAX_TILESET_FILENAME_SIZE without complaint, so an
- *       over-long path fails as a missing file rather than as a length error.
+ * @throws AKERR_OUTOFBOUNDS If `dirname` and the image name do not fit in
+ *         #AKGL_TILEMAP_MAX_TILESET_FILENAME_SIZE when joined, naming both
+ *         lengths. This used to truncate silently, so an over-long path failed
+ *         as a missing file rather than as the length error it is.
  */
 akerr_ErrorContext AKERR_NOIGNORE *akgl_tilemap_load_layer_image(akgl_Tilemap *dest, json_t *root, int layerid, akgl_String *dirname);
 /**