Give every exported function a declaration, and check that it stays that way

Closes internal-consistency items 7 through 15. Nineteen non-static functions
were in the ABI with no declaration anywhere, so no consumer could call them
and any consumer could collide with them.

The four gamepad_handle_* functions are the ones that mattered: controller.h
declared akgl_controller_handle_button_down and three siblings that did not
exist, so anything compiled against the header alone failed to link. The
definitions carry the declared names now, which also closes Defects -> Known
and still open item 10, and their documentation moved to the header.

The rest are either declared under a "part of the internal API" block --
akgl_game_save_actors and akgl_game_load_versioncmp, which tests/game.c had to
declare for itself, plus six tilemap loader helpers the untested-loader work
wants to reach -- or static, which is what the four save iterators and
load_objectnamemap should always have been. akgl_path_relative_from is deleted:
declared nowhere, called from nowhere, never wrote its output, and leaked a
pooled string on every call, so it closes Known and still open item 4 and item
40 by ceasing to exist.

scripts/check_api_surface.sh keeps it closed. It reads the built library's
dynamic symbol table and every public header with comments stripped, and fails
on an exported akgl_* symbol that is declared nowhere. Stripping comments is
the whole point -- four of these were mentioned in controller.h prose, which is
how they went unnoticed.

The pool-size ceilings are defined once, in heap.h, so the #ifndef override
hook fires for the first time; actor.h, sprite.h and character.h were defining
the same four unconditionally from headers heap.h includes above its own guard.
tests/header_pool_override.c fails the compile if that regresses.

Also here: (void) rather than () on the twelve no-argument entry points,
AKERR_NOIGNORE only on declarations, static helpers with the akgl_ prefix
dropped, and the six parameter-name mismatches. akgl_get_json_with_default had
its two contexts swapped rather than merely misspelled -- the incoming one was
`err` and its own was `e`, which is the name reserved for an incoming one.

24/24 pass, reindent --check clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -302,6 +302,20 @@ endforeach()
 
 add_test(NAME semver_unit COMMAND akgl_test_semver_unit)
 
+# Not a C program, so it is not in AKGL_TEST_SUITES: it reads the built library's
+# dynamic symbol table and every public header, and fails when a function with
+# external linkage is declared nowhere. That is an ABI question rather than a
+# behavioural one, and nineteen symbols had drifted out of the headers before
+# anything was checking.
+add_test(
+  NAME api_surface
+  COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/scripts/check_api_surface.sh
+          $<TARGET_FILE:akgl>
+          ${CMAKE_CURRENT_SOURCE_DIR}/include
+          ${CMAKE_CURRENT_BINARY_DIR}/include
+)
+set_tests_properties(api_surface PROPERTIES SKIP_RETURN_CODE 2)
+
 # One translation unit per public header, each including exactly that header and
 # nothing before it. This is the only shape that proves a header is
 # self-contained: a second #include in the same file proves nothing about the
@@ -325,6 +339,9 @@ int akgl_header_selftest_${header}(void)\n\
   list(APPEND AKGL_HEADER_SELFTEST_SOURCES "${generated}")
 endforeach()
 target_sources(akgl_test_headers PRIVATE ${AKGL_HEADER_SELFTEST_SOURCES})
+# Hand-written rather than generated: it checks a header's behaviour under a
+# caller-supplied override, which is not something the generated shape covers.
+target_sources(akgl_test_headers PRIVATE tests/header_pool_override.c)
 
 # TIMEOUT is generous because CTest applies the same property to `ctest -T
 # memcheck`, where every suite runs under valgrind at something like twenty