Version at 0.2.0: complete the wishlist, document it, gate the docs

Closes what was left of TODO.md sections 1, 2 and 3, and rewrites that
file to hold outstanding items only.

The API break gets a minor bump, because pre-1.0 the soname carries
MAJOR.MINOR and 0.1 and 0.2 are therefore different ABIs. Five
signatures changed and the ato* contract with them; UPGRADING.md is new
and lists every one, with the before/after for the cases the compiler
cannot warn about.

Section 3.1 is finished: reallocarray with the multiplication checked,
aligned_alloc and posix_memalign, asprintf/vasprintf, scanf/vscanf.
Four functions on that list are deliberately absent rather than missing
-- sprintf, strtok, setbuf and perror -- and TODO.md now says which and
why, so nobody adds them thinking they were forgotten.

Section 1.9, the cross-cutting tests:

  tests/test_pool.c    drives every failure path AKERR_MAX_ARRAY_ERROR
                       + 10 times and checks the pool after each round,
                       because a wrapper that leaks a slot fails a
                       hundred calls later in unrelated code. It also
                       asserts that each error names the function and
                       file it was raised from, which is what catches a
                       FAIL that migrates into a helper during a
                       refactor: status right, message right, origin
                       quietly lying.
  tests/negative/      two sources that must FAIL to compile, built with
                       -Werror and registered WILL_FAIL. AKERR_NOIGNORE
                       and the format attributes are enforced by the
                       compiler and by nothing else; drop either and
                       every ordinary test still passes.

Thread safety is answered rather than tested: the library is not
thread-safe and cannot be made so from here, because libakerror's error
pool is an unlocked process-global array. README.md says so plainly and
TODO.md carries it as the item blocking any future pthread wrappers.

Doxygen is configured and gated. All 147 public functions have @brief,
a @param each, @throws per status and @return; EXTRACT_ALL is off and
WARN_NO_PARAMDOC on, so `cmake --build build --target docs` fails on an
undocumented entity. It ran to 0 warnings. The Doxyfile carries no
version -- cmake/RunDoxygen.cmake feeds PROJECT_NUMBER in from
project(), so that stays the one place a version is written.

CI now builds against the submodule it pins instead of also installing
libakerror@main and never linking it, adds -Werror, and gains a
sanitizer job. The pre-push hook matches, and runs the docs check too.

Coverage: 99.5% of lines (1643/1651), 100% of functions (147/147). The
eight uncovered lines are each uncovered on purpose and TODO.md says
which and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cmake/RunDoxygen.cmake

@@ -0,0 +1,49 @@
+# Run doxygen with PROJECT_NUMBER supplied from CMake, and fail on any warning.
+#
+# Driven by the `docs` target in the top-level CMakeLists.txt. It is a separate
+# script rather than a COMMAND because it has to do three things in sequence --
+# feed the configuration in, then read the log back, then decide -- and a
+# custom-target command list cannot branch on the result of an earlier command.
+#
+# The version comes in from CMake rather than living in the Doxyfile so that
+# project() stays the single place a version number is written.
+
+if(NOT AKSL_DOXYGEN OR NOT AKSL_SOURCE_DIR OR NOT AKSL_VERSION)
+  message(FATAL_ERROR "RunDoxygen.cmake needs AKSL_DOXYGEN, AKSL_SOURCE_DIR and AKSL_VERSION")
+endif()
+
+set(_doxyfile "${AKSL_SOURCE_DIR}/Doxyfile")
+set(_logfile  "${AKSL_SOURCE_DIR}/doxygen-warnings.log")
+file(READ "${_doxyfile}" _config)
+# Later settings win in a Doxyfile, so appending is enough to override.
+set(_config "${_config}\nPROJECT_NUMBER = ${AKSL_VERSION}\n")
+
+set(_generated "${AKSL_SOURCE_DIR}/Doxyfile.generated")
+file(WRITE "${_generated}" "${_config}")
+
+execute_process(
+  COMMAND "${AKSL_DOXYGEN}" "${_generated}"
+  WORKING_DIRECTORY "${AKSL_SOURCE_DIR}"
+  RESULT_VARIABLE _result
+  OUTPUT_QUIET
+)
+file(REMOVE "${_generated}")
+
+if(NOT _result EQUAL 0)
+  message(FATAL_ERROR "doxygen exited ${_result}")
+endif()
+
+# WARN_IF_UNDOCUMENTED and WARN_NO_PARAMDOC are on, so anything in the log is a
+# public function, parameter or return value nobody has described. Treat it the
+# way an uncovered line or a surviving mutant is treated: as work, not as noise.
+if(EXISTS "${_logfile}")
+  file(READ "${_logfile}" _warnings)
+  string(STRIP "${_warnings}" _warnings)
+  if(NOT _warnings STREQUAL "")
+    message("${_warnings}")
+    message(FATAL_ERROR
+            "doxygen reported undocumented entities; see doxygen-warnings.log")
+  endif()
+endif()
+
+message(STATUS "API documentation written to ${AKSL_SOURCE_DIR}/doxygen/html")