Test aksl_vscanf, and drop a check that could not fail

Coverage caught both. aksl_vscanf was declared, documented and never
called by anything, which is what 100% function coverage is for -- it is
the only metric here that notices a whole function nobody exercises.

aksl_vasprintf had a second vsnprintf whose return it compared against
the first, and a CLEANUP block to free the buffer when they disagreed.
They cannot disagree: the buffer was sized by vsnprintf from the same
format string and the same arguments a few lines earlier. So that was a
failure branch nothing can reach and a free() beneath it that nothing
can execute -- exactly the dead code TODO.md 2.2.11 recorded against the
old aksl_memset and aksl_memcpy, and removing those was the point. The
invariant is a comment now, where it can be read.

Back to 99.5% of lines (1708/1716) and 100% of functions (154/154), with
the eight uncovered lines the ones TODO.md already accounts for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -360,10 +360,10 @@ cmake -S . -B build-coverage -DAKSL_COVERAGE=ON \
 | file | lines | branches | functions |
 |---|---|---|---|
 | `src/collections.c` | 99.3% (601/605) | 43.5% | 100% (43/43) |
-| `src/stdlib.c` | 99.3% (557/561) | 46.5% | 100% (50/50) |
-| `src/stream.c` | 100% (274/274) | 43.4% | 100% (31/31) |
+| `src/stdlib.c` | 99.4% (614/618) | 46.5% | 100% (55/55) |
+| `src/stream.c` | 100% (282/282) | 43.4% | 100% (33/33) |
 | `src/string.c` | 100% (211/211) | 53.8% | 100% (23/23) |
-| **total** | **99.5% (1643/1651)** | **46.0%** | **100% (147/147)** |
+| **total** | **99.5% (1708/1716)** | **46.0%** | **100% (154/154)** |
 
 so the 90/40 gate above is a ratchet with headroom rather than a target. Eight
 lines are uncovered and each is uncovered on purpose: