Stop a failed controller-DB fetch from destroying the tracked fallback

Closes Defects -> Known and still open item 12, both halves.

include/akgl/SDL_GameControllerDB.h is tracked on purpose: it is the offline
fallback that keeps the library buildable when upstream is unreachable. The
script that writes it had no set -e and never checked curl, so a failed fetch
wrote AKGL_SDL_GAMECONTROLLER_DB_LEN 0 and an empty array over the good copy
and exited 0. The safety net destroyed itself, and because CMake re-ran the
generator on every build, an offline build was enough to do it.

The script now runs under set -euo pipefail, fetches into a temporary
directory, and moves the result into place only after checking curl's exit
status (with --fail, so an HTTP error is a status rather than an error page in
the body), a plausible minimum mapping count, and that no mapping carries a
quote or backslash that would break the C string literal it becomes. Any of
those failing leaves the tracked header exactly as it was and exits non-zero.

Verified against all five failure modes -- unresolvable host, 404, truncated
response, empty-but-successful response (the original failure exactly), and a
response containing a quote. Each refuses, and the header's checksum is
unchanged after every one. AKGL_CONTROLLERDB_URL and
AKGL_CONTROLLERDB_MIN_LINES are environment-overridable, which is how.

The build no longer runs it at all. The add_custom_command declared a relative
OUTPUT, which CMake resolves against the binary directory while the script
writes to the source directory, so the declared output never appeared and every
build re-ran the command -- needing network access and leaving the tree dirty.
It is an explicit `controllerdb` target now, and the header is no longer listed
as a library source, which is all it was there for.

The empty-initializer problem goes with it: an empty array initializer is a
constraint violation in ISO C that compiles only as a GCC extension, and the
minimum-count check guarantees at least one entry.

Also here, because it rested on a premise that turned out to be false: the
character suite is no longer excluded from CI's coverage and memory-check jobs,
nor from the mutation harness by default. It was excluded on the grounds that
it failed deliberately. It did not -- it was reporting success while running
one of its four tests.

25/25 pass, memcheck clean, shellcheck clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

mkcontrollermappings.sh

@@ -1,32 +1,108 @@
 #!/bin/bash
+#
+# Regenerate include/akgl/SDL_GameControllerDB.h from the community controller
+# database.
+#
+# That header is tracked on purpose: it is the offline fallback that keeps the
+# library buildable when upstream is renamed, rate-limited, taken down, or
+# simply unreachable. This script therefore has one rule above all others --
+# **it must never replace a good header with a worse one**. Until 0.5.0 it did
+# exactly that: no `set -e`, no check on curl's exit status, so a failed fetch
+# wrote an empty mappings file, overwrote the good tracked header with
+# `AKGL_SDL_GAMECONTROLLER_DB_LEN 0` and an empty initializer, and exited 0.
+# Verified by pointing it at an unresolvable host.
+#
+# Everything is assembled in a temporary directory and moved into place only
+# once it has been checked. A failure leaves the existing header untouched and
+# exits non-zero.
+#
+# This is no longer run by an ordinary build. `cmake --build build --target
+# controllerdb` is the deliberate way to update the mappings, so a build needs
+# no network access and does not leave the working tree dirty.
+#
+# Usage: mkcontrollermappings.sh <repository-root>
 
-rootdir=$1
+set -euo pipefail
 
-curl https://raw.githubusercontent.com/mdqinc/SDL_GameControllerDB/refs/heads/master/gamecontrollerdb.txt | grep -v '^#' | grep -v '^$' | sed s/',$'//g > mappings.txt
+AKGL_CONTROLLERDB_URL="${AKGL_CONTROLLERDB_URL:-https://raw.githubusercontent.com/mdqinc/SDL_GameControllerDB/refs/heads/master/gamecontrollerdb.txt}"
+# A floor, not a target. The database has carried well over two thousand entries
+# for years; a few hundred means something truncated the response, which is a
+# fetch that "succeeded" and still must not be committed.
+AKGL_CONTROLLERDB_MIN_LINES="${AKGL_CONTROLLERDB_MIN_LINES:-1000}"
 
-filelen=$(wc -l mappings.txt | cut -d ' ' -f 1)
+function die()
+{
+    echo "mkcontrollermappings: $*" >&2
+    exit 1
+}
 
-cat > ${rootdir}/include/akgl/SDL_GameControllerDB.h <<EOF
-#ifndef _SDL_GAMECONTROLLERDB_H_
-#define _SDL_GAMECONTROLLERDB_H_
+if [[ $# -lt 1 ]]; then
+    die "usage: $0 <repository-root>"
+fi
 
-// Taken from https://raw.githubusercontent.com/mdqinc/SDL_GameControllerDB/refs/heads/master/gamecontrollerdb.txt on $(date)
+rootdir="$1"
+target="${rootdir}/include/akgl/SDL_GameControllerDB.h"
 
-#define AKGL_SDL_GAMECONTROLLER_DB_LEN         ${filelen}
+if [[ ! -d "${rootdir}/include/akgl" ]]; then
+    die "no such directory: ${rootdir}/include/akgl"
+fi
+command -v curl >/dev/null 2>&1 || die "curl is not available"
 
-const char *SDL_GAMECONTROLLER_DB[] = {
-EOF
+workdir="$(mktemp -d)"
 
-counter=0
+function cleanup()
+{
+    rm -rf "${workdir}"
+}
+trap cleanup EXIT
 
-cat mappings.txt | while read LINE;
-do
-    if [[ $counter -gt 0 ]]; then
-	printf ",\n" >> ${rootdir}/include/akgl/SDL_GameControllerDB.h;
-    fi
-    printf "    \"${LINE}\"" >> ${rootdir}/include/akgl/SDL_GameControllerDB.h;
-    counter=$((counter + 1))
-done
+raw="${workdir}/raw.txt"
+mappings="${workdir}/mappings.txt"
+staged="${workdir}/SDL_GameControllerDB.h"
 
-printf "\n};\n" >> ${rootdir}/include/akgl/SDL_GameControllerDB.h
-printf "#endif // _SDL_GAMECONTROLLERDB_H_\n" >> ${rootdir}/include/akgl/SDL_GameControllerDB.h
+# --fail so an HTTP error status is an exit status rather than an error page in
+# the body. Not a pipeline: the exit status being checked is curl's, and a
+# pipeline reports the last command's.
+if ! curl --fail --silent --show-error --location "${AKGL_CONTROLLERDB_URL}" --output "${raw}"; then
+    die "fetch failed from ${AKGL_CONTROLLERDB_URL}; ${target} left as it was"
+fi
+
+grep -v '^#' "${raw}" | grep -v '^$' | sed s/',$'//g > "${mappings}" || true
+
+filelen=$(wc -l < "${mappings}" | tr -d ' ')
+
+if [[ "${filelen}" -lt "${AKGL_CONTROLLERDB_MIN_LINES}" ]]; then
+    die "fetched only ${filelen} mappings, expected at least ${AKGL_CONTROLLERDB_MIN_LINES}; ${target} left as it was"
+fi
+
+# Every mapping becomes a C string literal, so a quote or a backslash would
+# produce a header that does not compile -- or, worse, one that does.
+if grep -q '["\\]' "${mappings}"; then
+    die "fetched mappings contain a quote or a backslash; ${target} left as it was"
+fi
+
+{
+    echo "#ifndef _AKGL_SDL_GAMECONTROLLERDB_H_"
+    echo "#define _AKGL_SDL_GAMECONTROLLERDB_H_"
+    echo ""
+    echo "// Taken from ${AKGL_CONTROLLERDB_URL} on $(date)"
+    echo ""
+    echo "#define AKGL_SDL_GAMECONTROLLER_DB_LEN         ${filelen}"
+    echo ""
+    echo "const char *SDL_GAMECONTROLLER_DB[] = {"
+    # One pass: wrap each mapping as a quoted, indented, comma-terminated entry,
+    # then drop the trailing comma from the last. An empty initializer is a
+    # constraint violation in ISO C that compiles only as a GCC extension, and
+    # the length check above is what guarantees there is at least one entry.
+    sed -e 's/.*/    "&",/' -e '$ s/,$//' "${mappings}"
+    echo "};"
+    echo "#endif // _AKGL_SDL_GAMECONTROLLERDB_H_"
+} > "${staged}"
+
+# Checked before it is allowed anywhere near the tracked copy.
+if ! grep -q "^#define AKGL_SDL_GAMECONTROLLER_DB_LEN  *${filelen}\$" "${staged}"; then
+    die "staged header did not come out as expected; ${target} left as it was"
+fi
+
+mv "${staged}" "${target}"
+echo "mkcontrollermappings: wrote ${filelen} mappings to ${target}"