Fix every memory defect the checker found, and bump to 0.4.0

Six findings, all of them libakgl's, all closed. The memcheck run is clean.

Not one of the four json_load_file calls in src/ was ever matched by a
json_decref, so every asset load abandoned its parsed document: 1.5 KB per
sprite, 2.1 KB per character, 9 KB per load of the 2x2 fixture map, and on
the order of a megabyte for a real one. Each loader now releases it in the
CLEANUP block it already had, on the success path as well as the failure
one. akgl_registry_load_properties needed its loop moved inside the ATTEMPT
block first: props is a borrowed reference into the document and is read
after the block ends, so every exit from that loop leaked the whole tree.

akgl_get_property copied a fixed AKGL_MAX_STRING_LENGTH bytes out of what
SDL handed back, which is SDL's strdup of the value -- four bytes for
"0.0". That read up to 4 KiB past the end of somebody else's allocation on
every property read, returned whatever was there past the terminator, and
would have faulted on a value that landed at the end of a page. It copies
the value and its terminator now, and refuses a value too long for an
akgl_String rather than truncating it into an unterminated buffer. The
header note that described the overread as a quirk describes correct
behaviour instead.

The four savegame name tables wrote a fixed-width field starting at the
registry key, and SDL sizes that allocation to the name. They read past it
on every entry and put what they found into the save file: up to half a
kilobyte of this process's heap per registered object, in a file a player
might send to somebody. They stage through a zeroed buffer now, and a
negative-array-size typedef fails the build if a table's width ever outgrows
it.

akgl_controller_list_keyboards never freed the array SDL_GetKeyboards
allocated for it.

A font could be opened and published and never handed back -- there was no
way to close one, so a game that changed fonts between scenes leaked ten
kilobytes each time, and loading over a live name leaked the font it
displaced. akgl_text_unloadfont is that missing half, and akgl_text_loadfont
calls it when it replaces a name, after the new font has opened so a failed
reload leaves the caller with the font they had. A new public symbol takes
the version to 0.4.0 and the soname with it: an 0.3 consumer cannot be
handed this library and told it is the same ABI.

tests/registry.c fills a destination with a sentinel and asserts the bytes
past the terminator survive a read, which fails against the old copy.
tests/text.c covers unload, double unload, unloading a name that was never
registered, and replacement closing the displaced font. The JSON releases
have no test of their own and cannot sensibly have one -- nothing in the
public API can observe a jansson refcount -- so the memcheck run is their
test, which is an argument for gating it rather than against.

The two remaining findings are in deps/semver's own unit test, which is
vendored. They are suppressed by function name, so a rewrite of those cases
comes back as a finding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/game.c

@@ -50,6 +50,72 @@ static akerr_ErrorContext *write_exact(const void *ptr, size_t size, size_t nmem
     return aksl_fwrite(ptr, size, nmemb, fp, &transferred);
 }
 
+/**
+ * @brief Widest name field any of the save tables writes.
+ *
+ * The spritesheet table is the widest at #AKGL_SPRITE_SHEET_MAX_FILENAME_LENGTH;
+ * the other three are name lengths half that or less.
+ */
+#define AKGL_GAME_SAVE_MAX_NAME_FIELD   AKGL_SPRITE_SHEET_MAX_FILENAME_LENGTH
+
+/**
+ * @brief Fail the build if a table ever declares a field wider than the staging buffer.
+ *
+ * A negative array size is a compile error, so widening one of these constants
+ * without widening #AKGL_GAME_SAVE_MAX_NAME_FIELD cannot get past the compiler
+ * and turn back into the overread this buffer exists to prevent.
+ */
+typedef char akgl_game_save_name_field_fits[
+    ((AKGL_ACTOR_MAX_NAME_LENGTH <= AKGL_GAME_SAVE_MAX_NAME_FIELD) &&
+     (AKGL_SPRITE_MAX_NAME_LENGTH <= AKGL_GAME_SAVE_MAX_NAME_FIELD) &&
+     (AKGL_SPRITE_SHEET_MAX_FILENAME_LENGTH <= AKGL_GAME_SAVE_MAX_NAME_FIELD) &&
+     (AKGL_SPRITE_MAX_CHARACTER_NAME_LENGTH <= AKGL_GAME_SAVE_MAX_NAME_FIELD)) ? 1 : -1];
+
+/**
+ * @brief Write a registry key as a fixed-width, zero-padded field.
+ *
+ * The name tables are read back without a length prefix, so every entry has to
+ * occupy exactly @p width bytes. Writing @p width bytes *from the key itself*
+ * is what the four iterators used to do, and the key is an SDL allocation sized
+ * to the name -- 40 bytes for `benchactor0`. That read past the end of it on
+ * every entry, and put whatever was next to it in the heap into the save file:
+ * up to half a kilobyte of this process's memory per registered object, in a
+ * file a player might send to somebody else.
+ *
+ * Staging through a zeroed buffer costs one `memset` per entry and makes the
+ * padding deterministic, which the reader wanted anyway.
+ *
+ * @param name  The registry key. Required, and NUL-terminated -- it comes from
+ *              SDL's property table, which stores C strings.
+ * @param width Field width in bytes, including the padding. Required to be at
+ *              most #AKGL_GAME_SAVE_MAX_NAME_FIELD; the compile-time check
+ *              above is what keeps that true for the four call sites.
+ * @param fp    Open output stream. Required.
+ * @return `NULL` on success, otherwise an error context owned by the caller.
+ * @throws AKERR_NULLPOINTER If @p name or @p fp is `NULL`.
+ * @throws AKERR_OUTOFBOUNDS If @p width exceeds the staging buffer.
+ */
+static akerr_ErrorContext *write_name_field(const char *name, size_t width, FILE *fp)
+{
+    char field[AKGL_GAME_SAVE_MAX_NAME_FIELD];
+
+    PREPARE_ERROR(e);
+    FAIL_ZERO_RETURN(e, name, AKERR_NULLPOINTER, "NULL name");
+    FAIL_ZERO_RETURN(e, fp, AKERR_NULLPOINTER, "NULL file pointer");
+    FAIL_NONZERO_RETURN(
+	e,
+	(width > sizeof(field)),
+	AKERR_OUTOFBOUNDS,
+	"Name field width %zu exceeds the staging buffer (%zu)",
+	width,
+	sizeof(field));
+
+    memset(&field, 0x00, sizeof(field));
+    strncpy((char *)&field, name, (width - 1));
+    PASS(e, write_exact((char *)&field, 1, width, fp));
+    SUCCEED_RETURN(e);
+}
+
 static akerr_ErrorContext *read_exact(void *ptr, size_t size, size_t nmemb, FILE *fp)
 {
     size_t transferred;
@@ -216,7 +282,7 @@ void akgl_game_save_actorname_iterator(void *userdata, SDL_PropertiesID props, c
     PREPARE_ERROR(e);
     ATTEMPT {
 	FAIL_ZERO_BREAK(e, fp, AKERR_NULLPOINTER, "NULL file pointer");
-	CATCH(e, write_exact((char *)name, 1, AKGL_ACTOR_MAX_NAME_LENGTH, fp));
+	CATCH(e, write_name_field(name, AKGL_ACTOR_MAX_NAME_LENGTH, fp));
 	actor = SDL_GetPointerProperty(props, name, NULL);
 	CATCH(e, write_exact(&actor, 1, sizeof(akgl_Actor *), fp));
     } CLEANUP {
@@ -245,7 +311,7 @@ void akgl_game_save_spritename_iterator(void *userdata, SDL_PropertiesID props,
     ATTEMPT {
 	FAIL_ZERO_BREAK(e, fp, AKERR_NULLPOINTER, "NULL file pointer");
 	sprite = SDL_GetPointerProperty(props, name, NULL);
-	CATCH(e, write_exact((char *)name, 1, AKGL_SPRITE_MAX_NAME_LENGTH, fp));
+	CATCH(e, write_name_field(name, AKGL_SPRITE_MAX_NAME_LENGTH, fp));
 	CATCH(e, write_exact(&sprite, 1, sizeof(akgl_Sprite *), fp));
     } CLEANUP {
     } PROCESS(e) {
@@ -277,7 +343,7 @@ void akgl_game_save_spritesheetname_iterator(void *userdata, SDL_PropertiesID pr
     ATTEMPT {
 	FAIL_ZERO_BREAK(e, fp, AKERR_NULLPOINTER, "NULL file pointer");
 	spritesheet = SDL_GetPointerProperty(props, name, NULL);
-	CATCH(e, write_exact((char *)name, 1, AKGL_SPRITE_SHEET_MAX_FILENAME_LENGTH, fp));
+	CATCH(e, write_name_field(name, AKGL_SPRITE_SHEET_MAX_FILENAME_LENGTH, fp));
 	CATCH(e, write_exact(&spritesheet, 1, sizeof(akgl_SpriteSheet *), fp));
     } CLEANUP {
     } PROCESS(e) {
@@ -305,7 +371,7 @@ void akgl_game_save_charactername_iterator(void *userdata, SDL_PropertiesID prop
     ATTEMPT {
 	FAIL_ZERO_BREAK(e, fp, AKERR_NULLPOINTER, "NULL file pointer");
 	character = SDL_GetPointerProperty(props, name, NULL);
-	CATCH(e, write_exact((char *)name, 1, AKGL_SPRITE_MAX_CHARACTER_NAME_LENGTH, fp));
+	CATCH(e, write_name_field(name, AKGL_SPRITE_MAX_CHARACTER_NAME_LENGTH, fp));
 	CATCH(e, write_exact(&character, 1, sizeof(akgl_Character *), fp));
     } CLEANUP {
     } PROCESS(e) {