Give every exported function a declaration, and check that it stays that way

Closes internal-consistency items 7 through 15. Nineteen non-static functions
were in the ABI with no declaration anywhere, so no consumer could call them
and any consumer could collide with them.

The four gamepad_handle_* functions are the ones that mattered: controller.h
declared akgl_controller_handle_button_down and three siblings that did not
exist, so anything compiled against the header alone failed to link. The
definitions carry the declared names now, which also closes Defects -> Known
and still open item 10, and their documentation moved to the header.

The rest are either declared under a "part of the internal API" block --
akgl_game_save_actors and akgl_game_load_versioncmp, which tests/game.c had to
declare for itself, plus six tilemap loader helpers the untested-loader work
wants to reach -- or static, which is what the four save iterators and
load_objectnamemap should always have been. akgl_path_relative_from is deleted:
declared nowhere, called from nowhere, never wrote its output, and leaked a
pooled string on every call, so it closes Known and still open item 4 and item
40 by ceasing to exist.

scripts/check_api_surface.sh keeps it closed. It reads the built library's
dynamic symbol table and every public header with comments stripped, and fails
on an exported akgl_* symbol that is declared nowhere. Stripping comments is
the whole point -- four of these were mentioned in controller.h prose, which is
how they went unnoticed.

The pool-size ceilings are defined once, in heap.h, so the #ifndef override
hook fires for the first time; actor.h, sprite.h and character.h were defining
the same four unconditionally from headers heap.h includes above its own guard.
tests/header_pool_override.c fails the compile if that regresses.

Also here: (void) rather than () on the twelve no-argument entry points,
AKERR_NOIGNORE only on declarations, static helpers with the akgl_ prefix
dropped, and the six parameter-name mismatches. akgl_get_json_with_default had
its two contexts swapped rather than merely misspelled -- the incoming one was
`err` and its own was `e`, which is the name reserved for an incoming one.

24/24 pass, reindent --check clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/util.c

@@ -27,7 +27,8 @@
  * the join, so symlinks and `..` are folded out and the result is absolute. It
  * is the fallback, reached only once resolving @p path on its own has failed.
  *
- * Not declared in util.h -- it is reachable only through akgl_path_relative.
+ * `static`: it is reachable only through akgl_path_relative, which is the only
+ * caller and the only sensible one.
  *
  * @param root Directory to resolve against, normally `dirname` of the file that
  *             named @p path. Required. A trailing `/` is harmless; the join adds
@@ -50,7 +51,7 @@
  *       scratch strings are never released. This is exactly the hazard AGENTS.md
  *       warns about; it wants a `FAIL_BREAK`.
  */
-akerr_ErrorContext *akgl_path_relative_root(char *root, char *path, akgl_String *dst)
+static akerr_ErrorContext *path_relative_root(char *root, char *path, akgl_String *dst)
 {
     PREPARE_ERROR(e);
     akgl_String *pathbuf;
@@ -128,47 +129,11 @@ akerr_ErrorContext *akgl_path_relative(char *root, char *path, akgl_String *dst)
     } FINISH(e, true);
 
     if ( relative_to_root == true ) {
-	PASS(e, akgl_path_relative_root(root, path, dst));
+	PASS(e, path_relative_root(root, path, dst));
     }
     SUCCEED_RETURN(e);
 }
 
-/**
- * @brief Intended to resolve @p path against the directory holding @p from. Unfinished.
- *
- * The shape is there -- resolve @p from, take its `dirname` -- but the body
- * stops before it does anything with @p path, and `*dst` is never written. Not
- * declared in util.h, and nothing in the tree calls it.
- *
- * @param path The path to resolve. Required, and currently ignored past the
- *             `NULL` check.
- * @param from A file whose directory @p path should be taken as relative to.
- *             Required. Must exist -- it is resolved with `realpath(3)`.
- * @param dst  Intended to receive the resolved path. Never written. Note the
- *             double indirection, which disagrees with the rest of the
- *             `akgl_path_relative*` family; see TODO.md item 40.
- * @return `NULL` on success, otherwise an error context owned by the caller.
- * @throws AKERR_NULLPOINTER If @p path or @p from is `NULL`.
- * @throws ENOENT If @p from does not exist, along with any other `errno`
- *         `realpath(3)` raises.
- * @throws AKGL_ERR_HEAP If the string pool is exhausted.
- *
- * @warning Known defect: the scratch string it claims is never released, so 256
- *          calls exhaust the string pool. TODO.md, "Known and still open" item 4.
- */
-akerr_ErrorContext *akgl_path_relative_from(char *path, char *from, akgl_String **dst)
-{
-    akgl_String *dirnamestr;
-    PREPARE_ERROR(e);
-    FAIL_ZERO_RETURN(e, path, AKERR_NULLPOINTER, "path");
-    FAIL_ZERO_RETURN(e, from, AKERR_NULLPOINTER, "from");
-    PASS(e, akgl_heap_next_string(&dirnamestr));
-    PASS(e, aksl_realpath(from, (char *)&dirnamestr->data, sizeof(dirnamestr->data)));
-    dirname((char *)&dirnamestr->data);
-
-    SUCCEED_RETURN(e);
-}
-
 akerr_ErrorContext *akgl_rectangle_points(akgl_RectanglePoints *dest, SDL_FRect *rect)
 {
     PREPARE_ERROR(errctx);