Namespace every exported symbol, and bump to 0.5.0

Closes internal-consistency items 1 through 6, 12 and 13. Every include guard
is _AKGL_<FILE>_H_, every in-project header include is angled, and every
exported function, type and global carries the akgl_ prefix. This is an ABI
break; the soname goes to libakgl.so.0.5. TODO.md carries the full rename
table.

The renames were driven by renaming each declaration and letting the compiler
find the uses, not by pattern substitution: renderer, physics and camera are
also parameter and struct-member names, and a sed would have rewritten
map->physics and every akgl_RenderBackend *renderer parameter without a word.

Item 4 turned out not to be cosmetic. The library exported a global called
renderer and tests/character.c defined an SDL_Renderer *renderer of its own;
the executable's definition preempted the library's, akgl_sprite_load_json
read a SDL_Renderer * through an akgl_RenderBackend *, and every texture load
in that suite failed. The suite reported success anyway, because libakerror's
unhandled-error handler ends in exit(errctx->status), exit keeps only the low
byte, and AKGL_ERR_SDL is exactly 256. So character had been green while
running one of its four tests, and every suite in the tree was unable to fail
on the most common status in a library built on SDL.

Both are fixed. tests/testutil.h gains TEST_TRAP_UNHANDLED_ERRORS(), which
collapses any status a byte cannot carry onto 1, and every suite installs it.
character binds a real backend with akgl_render_2d_bind. Its fourth test then
runs for the first time and fails on a defect it has asserted all along, so
akgl_heap_release_character now walks state_sprites with
AKGL_ITERATOR_OP_RELEASE and destroys the property set before zeroing the slot
-- TODO.md Defects item 21 and half of Carried over item 1.

AKGL_TIME_ONESEC_MS said "one second in milliseconds" and held 1000000, so
akgl_game_state_lock waited roughly sixteen minutes rather than one second. It
is AKGL_TIME_ONEMS_NS now, the budget is its own named constant, and
tests/game.c holds the mutex from a second thread to assert the wait -- the
contended path had no coverage at all.

Headers are self-contained and it is enforced: AKGL_PUBLIC_HEADERS drives both
install() and a generated translation unit per header, so a header that ships
is a header that is checked. Writing that found registry.h, which used
SDL_PropertiesID in eight declarations and included no SDL header.

23/23 suites pass, memcheck is clean, reindent --check is clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Andrew Kesterson <andrew@aklabs.net>

AGENTS.md

@@ -187,12 +187,9 @@ For reference, `cc-mode` defines the style as:
 - `case` labels sit at the same column as their `switch` (`label . 0`).
 - Continuation lines of a wrapped expression indent one level (`statement-cont . +`).
 
-Most of `src/` already conforms. The known non-conforming files are
-`src/json_helpers.c`, `src/util.c` (from `akgl_rectangle_points` onward),
-`src/assets.c`, `src/staticstring.c`, parts of `src/actor.c`, and the headers
-`include/akgl/util.h` and `include/akgl/staticstring.h` — all of which use a
-2-column offset. Convert a file to the canonical style in its own commit, not
-mixed into a behavioral change.
+The whole tree conforms: `scripts/reindent.sh --check` is clean, and the
+pre-commit hook keeps it that way. Convert a file to the canonical style in its
+own commit, not mixed into a behavioral change.
 
 ### Braces
 
@@ -256,8 +253,9 @@ style drifted in the first place.
   embed a type name (`akgl_Actor_cmhf_left_on` is wrong; it should be
   `akgl_actor_cmhf_left_on`).
 - **Public types**: `akgl_TypeName` — `akgl_Actor`, `akgl_SpriteSheet`,
-  `akgl_PhysicsBackend`. Every type exported from a header takes the prefix;
-  bare names like `point` and `RectanglePoints` are defects, not precedent.
+  `akgl_PhysicsBackend`. Every type exported from a header takes the prefix.
+  `point` and `RectanglePoints` shipped bare until 0.5.0; they are
+  `akgl_Point` and `akgl_RectanglePoints` now, and neither is precedent.
 - **Constants and macros**: `AKGL_UPPER_SNAKE_CASE`. A constant belongs to the
   subsystem it describes: a character limit is `AKGL_CHARACTER_MAX_*`, not
   `AKGL_SPRITE_MAX_CHARACTER_*`. Name a constant for what its value *is* — a
@@ -266,6 +264,15 @@ style drifted in the first place.
   not add bare names (`renderer`, `camera`, `window`), leading-underscore names
   (reserved at file scope), or SCREAMING_SNAKE names for mutable objects —
   `AKGL_UPPER_SNAKE_CASE` is for constants.
+
+  This one is not cosmetic and there is a scar to prove it. Until 0.5.0 the
+  library exported `renderer`, and `tests/character.c` defined a
+  `SDL_Renderer *renderer` of its own. Both had external linkage and the same
+  spelling, so the executable's definition preempted the shared library's: the
+  library read a `SDL_Renderer *` through an `akgl_RenderBackend *`, every
+  texture load in that suite failed, and the suite reported success anyway. A
+  consuming game with a variable called `renderer` would have hit the same
+  thing with no test to notice.
 - **`static` helpers drop the `akgl_` prefix**, which exists only to avoid
   external collisions.
 - **Include guards**: `_AKGL_<FILE>_H_`, matching the file name. Guard names
@@ -321,6 +328,15 @@ Headers must be self-contained: include what you use, so that a translation unit
 including a single `akgl` header compiles without a particular include order.
 Within the project use the angled form, `#include <akgl/sibling.h>`.
 
+This is enforced. `AKGL_PUBLIC_HEADERS` in `CMakeLists.txt` lists every header
+installed into `include/akgl/`, and drives two things from that one list: what
+`install()` ships, and a generated translation unit per header — each including
+exactly that header and nothing before it — linked into the `headers` suite. A
+new header is covered by adding it to that list. One header per translation
+unit is the only shape that proves anything: a second `#include` after the
+first proves nothing about the second, because by then the first has dragged
+its dependencies in.
+
 Declare no-argument functions as `(void)`, not `()`.
 
 ## Rules
@@ -330,7 +346,15 @@ Declare no-argument functions as `(void)`, not `()`.
 
 ## Testing Guidelines
 
-Tests use simple executable return codes and are registered through CTest in `CMakeLists.txt`; there is no declared coverage threshold. Add focused tests as `tests/<feature>.c`, create a matching `test_<feature>` target, and register it with `add_test`. Put reusable fixtures in `tests/assets/` and keep paths compatible with tests launched from the build tree. Coverage mode wraps the suite in a CTest fixture so counters are reset before tests and reports are generated afterward.
+Tests use simple executable return codes and are registered through CTest in `CMakeLists.txt`; there is no declared coverage threshold.
+
+**Every suite's `main()` must call `TEST_TRAP_UNHANDLED_ERRORS()` immediately
+after `akgl_error_init()`.** libakerror's default unhandled-error handler ends
+in `exit(errctx->status)`, `exit` keeps only the low byte, and libakgl's status
+band starts at 256 — so a suite that failed with `AKGL_ERR_SDL` exited 0 and
+CTest recorded a pass. That is not hypothetical: `tests/character.c` aborted at
+its second of four tests on a bad renderer and was green until 0.5.0. The trap
+in `tests/testutil.h` collapses any status a byte cannot carry onto 1. Add focused tests as `tests/<feature>.c`, create a matching `test_<feature>` target, and register it with `add_test`. Put reusable fixtures in `tests/assets/` and keep paths compatible with tests launched from the build tree. Coverage mode wraps the suite in a CTest fixture so counters are reset before tests and reports are generated afterward.
 
 ### Performance suites