Version at 0.2.0: complete the wishlist, document it, gate the docs

Closes what was left of TODO.md sections 1, 2 and 3, and rewrites that
file to hold outstanding items only.

The API break gets a minor bump, because pre-1.0 the soname carries
MAJOR.MINOR and 0.1 and 0.2 are therefore different ABIs. Five
signatures changed and the ato* contract with them; UPGRADING.md is new
and lists every one, with the before/after for the cases the compiler
cannot warn about.

Section 3.1 is finished: reallocarray with the multiplication checked,
aligned_alloc and posix_memalign, asprintf/vasprintf, scanf/vscanf.
Four functions on that list are deliberately absent rather than missing
-- sprintf, strtok, setbuf and perror -- and TODO.md now says which and
why, so nobody adds them thinking they were forgotten.

Section 1.9, the cross-cutting tests:

  tests/test_pool.c    drives every failure path AKERR_MAX_ARRAY_ERROR
                       + 10 times and checks the pool after each round,
                       because a wrapper that leaks a slot fails a
                       hundred calls later in unrelated code. It also
                       asserts that each error names the function and
                       file it was raised from, which is what catches a
                       FAIL that migrates into a helper during a
                       refactor: status right, message right, origin
                       quietly lying.
  tests/negative/      two sources that must FAIL to compile, built with
                       -Werror and registered WILL_FAIL. AKERR_NOIGNORE
                       and the format attributes are enforced by the
                       compiler and by nothing else; drop either and
                       every ordinary test still passes.

Thread safety is answered rather than tested: the library is not
thread-safe and cannot be made so from here, because libakerror's error
pool is an unlocked process-global array. README.md says so plainly and
TODO.md carries it as the item blocking any future pthread wrappers.

Doxygen is configured and gated. All 147 public functions have @brief,
a @param each, @throws per status and @return; EXTRACT_ALL is off and
WARN_NO_PARAMDOC on, so `cmake --build build --target docs` fails on an
undocumented entity. It ran to 0 warnings. The Doxyfile carries no
version -- cmake/RunDoxygen.cmake feeds PROJECT_NUMBER in from
project(), so that stays the one place a version is written.

CI now builds against the submodule it pins instead of also installing
libakerror@main and never linking it, adds -Werror, and gains a
sanitizer job. The pre-push hook matches, and runs the docs check too.

Coverage: 99.5% of lines (1643/1651), 100% of functions (147/147). The
eight uncovered lines are each uncovered on purpose and TODO.md says
which and why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/aksl_capture.h

@@ -170,6 +170,15 @@ static char aksl_last_message[AKERR_MAX_ERROR_CONTEXT_STRING_LENGTH];
 /* Sized to match akerr_ErrorContext.function, which akerror declares with
  * AKERR_MAX_ERROR_FNAME_LENGTH rather than AKERR_MAX_ERROR_FUNCTION_LENGTH. */
 static char aksl_last_function[AKERR_MAX_ERROR_FNAME_LENGTH];
+/*
+ * The source location the error was raised from. Captured so that
+ * tests/test_pool.c can assert an error came from the wrapper it names rather
+ * than from somewhere further down -- an error that reports the wrong origin is
+ * worse than useless when the only debugging you get is a log file after the
+ * fact, which is the stated reason this library exists.
+ */
+static char aksl_last_file[AKERR_MAX_ERROR_FNAME_LENGTH];
+static int aksl_last_line = 0;
 
 /*
  * Record the status/message/function of a returned context, release it back to
@@ -184,6 +193,8 @@ static int __attribute__((unused)) aksl_take(akerr_ErrorContext *e)
 
     aksl_last_message[0] = '\0';
     aksl_last_function[0] = '\0';
+    aksl_last_file[0] = '\0';
+    aksl_last_line = 0;
     if ( e == NULL ) {
 	aksl_last_status = 0;
 	return 0;
@@ -191,6 +202,8 @@ static int __attribute__((unused)) aksl_take(akerr_ErrorContext *e)
     aksl_last_status = e->status;
     snprintf(aksl_last_message, sizeof(aksl_last_message), "%s", e->message);
     snprintf(aksl_last_function, sizeof(aksl_last_function), "%s", e->function);
+    snprintf(aksl_last_file, sizeof(aksl_last_file), "%s", e->fname);
+    aksl_last_line = e->lineno;
     /*
      * akerr_release_error is marked warn_unused_result, and a (void) cast does
      * not silence that in GCC, so the result is assigned and discarded.
@@ -260,6 +273,8 @@ static int __attribute__((unused)) aksl_take(akerr_ErrorContext *e)
         aksl_last_status = 0;                                      \
         aksl_last_message[0] = '\0';                               \
         aksl_last_function[0] = '\0';                              \
+        aksl_last_file[0] = '\0';                                  \
+        aksl_last_line = 0;                                        \
     } while ( 0 )
 
 #define AKSL_CHECK_CONTAINS(needle)				\