Bound every array a data file can index

Closes Defects items 16 and 17 and Known-and-still-open item 6. All three let
an asset file, or a caller's argument, write past a fixed array.

akgl_sprite_load_json took its frame count straight from the document and wrote
that many entries into a 16-byte frameids -- through a uint32_t * cast of a
uint8_t *, so each write touched four bytes and the overrun reached four bytes
past the array, into the rest of akgl_Sprite and then the next pool slot. The
count is checked first now, each id is read into an int and narrowed
deliberately, and a frame number too large for a uint8_t is refused rather than
truncated into an index for a different tile.

The tilemap loader had the same shape twice: objects[j] with no check against
AKGL_TILEMAP_MAX_OBJECTS_PER_LAYER and tilesets[i] with none against
AKGL_TILEMAP_MAX_TILESETS. akgl_tilemap_load_layers already bounded its own
loop, so the pattern was in the same file. The object one is the reachable
half -- 128 objects is not a large object layer.

akgl_string_initialize zeroed sizeof(akgl_String) starting at `data`, which
begins after the refcount in front of it, so it ran four bytes past the end of
the object and onto the *next* slot's refcount -- the field the allocator reads
to decide whether a slot is free. Same file, same class, fixed with it:
akgl_string_copy accepted a count larger than the buffers, reading past one
pool slot and writing past another, which the header documented as behaviour.

Every case has a test that fails against the old code, with five new fixtures.
Exactly-the-maximum is asserted alongside one-past in each, so the bound cannot
be fixed by making the limit off by one.

25/25 pass, memcheck clean, reindent --check clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

include/akgl/staticstring.h

@@ -40,10 +40,10 @@ typedef struct
  * @return `NULL` on success, otherwise an error context owned by the caller.
  * @throws AKERR_NULLPOINTER If @p obj is `NULL`.
  *
- * @note Known defect: the `NULL` @p init path zeroes `sizeof(akgl_String)`
- *       bytes starting at `data`, which is four bytes past the end of the
- *       buffer -- `refcount` sits in front of it. TODO.md, "Known and still
- *       open" item 6.
+ * @note Until 0.5.0 the `NULL` @p init path zeroed `sizeof(akgl_String)` bytes
+ *       starting at `data`, which is four bytes past the end of the buffer --
+ *       `refcount` sits in front of it, so the overrun landed on the next pool
+ *       slot's reference count.
  */
 akerr_ErrorContext AKERR_NOIGNORE *akgl_string_initialize(akgl_String *obj, char *init);
 /**
@@ -58,11 +58,14 @@ akerr_ErrorContext AKERR_NOIGNORE *akgl_string_initialize(akgl_String *obj, char
  * @param count Maximum bytes to copy. 0 selects #AKGL_MAX_STRING_LENGTH, the
  *              whole buffer. A @p count shorter than the source truncates
  *              without writing a terminator; a @p count longer than the source
- *              zero-pads the remainder, per `strncpy`. Values above
- *              #AKGL_MAX_STRING_LENGTH overrun both buffers and are not
- *              rejected.
+ *              zero-pads the remainder, per `strncpy`. A negative @p count, or
+ *              one above #AKGL_MAX_STRING_LENGTH, is refused -- both buffers
+ *              are exactly that long, so a larger count walked off the end of
+ *              two pool slots at once.
  * @return `NULL` on success, otherwise an error context owned by the caller.
  * @throws AKERR_NULLPOINTER If @p src or @p dest is `NULL`.
+ * @throws AKERR_OUTOFBOUNDS If @p count is negative or above
+ *         #AKGL_MAX_STRING_LENGTH.
  * @throws errno Whatever `errno` holds if `strncpy` returns something other
  *         than @p dest. In practice `strncpy` always returns its destination, so
  *         this path is unreachable rather than merely rare.