Version at 0.2.0: complete the wishlist, document it, gate the docs

Closes what was left of TODO.md sections 1, 2 and 3, and rewrites that
file to hold outstanding items only.

The API break gets a minor bump, because pre-1.0 the soname carries
MAJOR.MINOR and 0.1 and 0.2 are therefore different ABIs. Five
signatures changed and the ato* contract with them; UPGRADING.md is new
and lists every one, with the before/after for the cases the compiler
cannot warn about.

Section 3.1 is finished: reallocarray with the multiplication checked,
aligned_alloc and posix_memalign, asprintf/vasprintf, scanf/vscanf.
Four functions on that list are deliberately absent rather than missing
-- sprintf, strtok, setbuf and perror -- and TODO.md now says which and
why, so nobody adds them thinking they were forgotten.

Section 1.9, the cross-cutting tests:

  tests/test_pool.c    drives every failure path AKERR_MAX_ARRAY_ERROR
                       + 10 times and checks the pool after each round,
                       because a wrapper that leaks a slot fails a
                       hundred calls later in unrelated code. It also
                       asserts that each error names the function and
                       file it was raised from, which is what catches a
                       FAIL that migrates into a helper during a
                       refactor: status right, message right, origin
                       quietly lying.
  tests/negative/      two sources that must FAIL to compile, built with
                       -Werror and registered WILL_FAIL. AKERR_NOIGNORE
                       and the format attributes are enforced by the
                       compiler and by nothing else; drop either and
                       every ordinary test still passes.

Thread safety is answered rather than tested: the library is not
thread-safe and cannot be made so from here, because libakerror's error
pool is an unlocked process-global array. README.md says so plainly and
TODO.md carries it as the item blocking any future pthread wrappers.

Doxygen is configured and gated. All 147 public functions have @brief,
a @param each, @throws per status and @return; EXTRACT_ALL is off and
WARN_NO_PARAMDOC on, so `cmake --build build --target docs` fails on an
undocumented entity. It ran to 0 warnings. The Doxyfile carries no
version -- cmake/RunDoxygen.cmake feeds PROJECT_NUMBER in from
project(), so that stays the one place a version is written.

CI now builds against the submodule it pins instead of also installing
libakerror@main and never linking it, adds -Werror, and gains a
sanitizer job. The pre-push hook matches, and runs the docs check too.

Coverage: 99.5% of lines (1643/1651), 100% of functions (147/147). The
eight uncovered lines are each uncovered on purpose and TODO.md says
which and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.githooks/pre-push

@@ -9,8 +9,9 @@
 #
 # Runs by default, a few seconds all in:
 #
-#     * default build      + ctest
+#     * default build      + ctest   (with -Werror, as CI has it)
 #     * ASan/UBSan build   + ctest
+#     * doxygen            -- fails on an undocumented public function
 #
 # Opt in to the slow harness (~25 minutes -- it rebuilds and re-runs the whole
 # suite once per mutant):
@@ -72,22 +73,40 @@ run() {
     fi
 }
 
+# -DAKSL_WERROR=ON here and not in a plain local build: a warning that stops you
+# mid-thought teaches people to turn warnings off, but a warning that reaches
+# main is one nobody will look at again. This is the last point where it is
+# still cheap to fix.
 echo "pre-push: default build + ctest"
-run cmake -S . -B "$builddir/default"
+run cmake -S . -B "$builddir/default" -DAKSL_WERROR=ON
 run cmake --build "$builddir/default"
 run ctest --test-dir "$builddir/default" --output-on-failure
 
 echo "pre-push: sanitizer build + ctest"
-run cmake -S . -B "$builddir/asan" -DAKSL_SANITIZE=ON
+run cmake -S . -B "$builddir/asan" -DAKSL_SANITIZE=ON -DAKSL_WERROR=ON
 run cmake --build "$builddir/asan"
 run ctest --test-dir "$builddir/asan" --output-on-failure
 
+# Doxygen runs with WARN_IF_UNDOCUMENTED and WARN_NO_PARAMDOC on and EXTRACT_ALL
+# off, so the target fails when a public function, parameter or return value has
+# nobody describing it. Skipped where doxygen is not installed rather than
+# failing: it is a documentation check, not a build dependency.
+if command -v doxygen > /dev/null 2>&1; then
+    echo "pre-push: doxygen"
+    run cmake --build "$builddir/default" --target docs
+else
+    echo "pre-push: doxygen not installed, skipping the documentation check"
+fi
+
 if [ "${AKSL_HOOK_MUTATION:-0}" = "1" ]; then
     echo "pre-push: mutation testing, threshold ${MUTATION_THRESHOLD}% (this takes a while)"
     # Deliberately not wrapped in run(): this one is slow enough that you want
     # to watch it make progress.
     if ! python3 scripts/mutation_test.py \
             --target src/stdlib.c \
+            --target src/string.c \
+            --target src/stream.c \
+            --target src/collections.c \
             --threshold "$MUTATION_THRESHOLD"; then
         echo >&2
         echo "pre-push: mutation score below ${MUTATION_THRESHOLD}%. Push aborted." >&2