Stop a failed controller-DB fetch from destroying the tracked fallback

Closes Defects -> Known and still open item 12, both halves.

include/akgl/SDL_GameControllerDB.h is tracked on purpose: it is the offline
fallback that keeps the library buildable when upstream is unreachable. The
script that writes it had no set -e and never checked curl, so a failed fetch
wrote AKGL_SDL_GAMECONTROLLER_DB_LEN 0 and an empty array over the good copy
and exited 0. The safety net destroyed itself, and because CMake re-ran the
generator on every build, an offline build was enough to do it.

The script now runs under set -euo pipefail, fetches into a temporary
directory, and moves the result into place only after checking curl's exit
status (with --fail, so an HTTP error is a status rather than an error page in
the body), a plausible minimum mapping count, and that no mapping carries a
quote or backslash that would break the C string literal it becomes. Any of
those failing leaves the tracked header exactly as it was and exits non-zero.

Verified against all five failure modes -- unresolvable host, 404, truncated
response, empty-but-successful response (the original failure exactly), and a
response containing a quote. Each refuses, and the header's checksum is
unchanged after every one. AKGL_CONTROLLERDB_URL and
AKGL_CONTROLLERDB_MIN_LINES are environment-overridable, which is how.

The build no longer runs it at all. The add_custom_command declared a relative
OUTPUT, which CMake resolves against the binary directory while the script
writes to the source directory, so the declared output never appeared and every
build re-ran the command -- needing network access and leaving the tree dirty.
It is an explicit `controllerdb` target now, and the header is no longer listed
as a library source, which is all it was there for.

The empty-initializer problem goes with it: an empty array initializer is a
constraint violation in ISO C that compiles only as a GCC extension, and the
minimum-count check guarantees at least one entry.

Also here, because it rested on a premise that turned out to be false: the
character suite is no longer excluded from CI's coverage and memory-check jobs,
nor from the mutation harness by default. It was excluded on the grounds that
it failed deliberately. It did not -- it was reporting success while running
one of its four tests.

25/25 pass, memcheck clean, shellcheck clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -196,10 +196,27 @@ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/include/akgl/version.h.in
 file(COPY "${CMAKE_CURRENT_SOURCE_DIR}/tests/assets"
      DESTINATION "${CMAKE_CURRENT_BINARY_DIR}")
 
-add_custom_command(
-  OUTPUT ${GAMECONTROLLERDB_H}
+# Regenerating the controller database is a deliberate act, not part of a build.
+#
+# This used to be an add_custom_command whose OUTPUT was the *relative* path
+# "include/akgl/SDL_GameControllerDB.h", which CMake resolves against the binary
+# directory while the script writes to the source directory. The declared output
+# therefore never appeared, the command was permanently out of date, and every
+# build re-ran it -- so every build needed network access and left the tracked
+# header dirty with a fresh $(date) stamp.
+#
+# `cmake --build build --target controllerdb` when newer mappings are actually
+# wanted. The result is its own commit, per AGENTS.md.
+if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
+  set(AKGL_CONTROLLERDB_TARGET controllerdb)
+else()
+  set(AKGL_CONTROLLERDB_TARGET akgl_controllerdb)
+endif()
+add_custom_target(${AKGL_CONTROLLERDB_TARGET}
   COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/mkcontrollermappings.sh ${CMAKE_CURRENT_SOURCE_DIR}
-  COMMENT "Generating controller mappings ..."
+  WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+  USES_TERMINAL
+  COMMENT "Fetching controller mappings and rewriting ${GAMECONTROLLERDB_H} ..."
 )
 
 # Add include directories
@@ -226,7 +243,6 @@ add_library(akgl SHARED
   src/tilemap.c
   src/util.c
   src/version.c
-  ${GAMECONTROLLERDB_H}
 )
 
 # While the major version is 0 the ABI is not stable across minor releases, so