Test the libc wrappers: 52% -> 99% line coverage

Every wrapper outside the list and tree code was untested. Six new test
files close that, following the plan already written in TODO.md 1.2-1.6:

  test_stream.c   fopen/fread/fwrite/fclose -- happy paths, the round
                  trip, AKERR_EOF on a short read, AKERR_IO on a stream
                  opened in the wrong mode, ENOENT, and the NULL guards
  test_format.c   printf/fprintf/sprintf -- text *and* count asserted
                  (stdout is pointed at a temp file to check aksl_printf),
                  all eight NULL guards, EBADF on a read-only stream, and
                  512 variadic calls in a loop as sanitizer cover for the
                  missing va_end
  test_convert.c  ato{i,l,ll,f} happy paths, negatives, leading
                  whitespace, NULL guards
  test_path.c     realpath on a file and on a symlink, both compared
                  against realpath(3) since TMPDIR may itself be a link;
                  ENOENT, ENOTDIR, NULL path
  test_strhash.c  djb2 known-answer vectors, len == 0, embedded NUL,
                  stability, NULL guards
  test_convert_strict.c
                  known-failing (2.1.5): the AKERR_VALUE / ERANGE
                  contract the ato* family cannot express today

test_tree.c gains the BFS AKERR_NOT_IMPLEMENTED contract, NULL arguments,
and a callback error that is not AKERR_ITERATOR_BREAK propagating out.

Tests deliberately say nothing about behaviour TODO.md records as
defective -- unchecked ptr/mode/resolved_path, short transfers reported as
success, *count left at -1, the djb2 sign extension -- so the eventual fix
does not have to come with a test rewrite. Each failure case in
test_path.c passes a zeroed buffer, because the wrapper's own error path
formats resolved_path with %s (2.1.6).

aksl_capture.h gains aksl_temp_file() with an atexit unlink backstop.
Without it every test that fails before its own unlink leaves temp files
behind -- which is the normal case for a known-failing test, and happens
173 times over in a mutation run.

Coverage on src/stdlib.c: 52.0% -> 99.0% of lines (200/202), 23.6% ->
51.0% of branches, 8/21 -> 21/21 functions. The two uncovered lines are
both `} HANDLE(e, AKERR_ITERATOR_BREAK) {`, where the macro starts with
the `break;` of PROCESS's `case 0:` arm -- reachable only via a non-NULL
error context whose status is zero, the pathology 2.2.1 exists to remove.

Mutation score on src/stdlib.c: 46.8% -> 89.6% (155/173 killed). CI, the
pre-push hook and the docs ratchet from 40 to 80 accordingly, and the 18
survivors are grouped by cause in TODO.md and README.md. A new CI
coverage job gates at 90% lines / 45% branches.

Verified:
  ctest --test-dir build            # 12/12
  ctest --test-dir build-asan       # 12/12 under ASan + UBSan
  ctest --test-dir build-coverage   # 14/14, report attached
  ctest --test-dir build -j8 --repeat until-fail:3
  gcc -Wall -Wextra -c on all nine test files  # no warnings
  python3 scripts/mutation_test.py --target src/stdlib.c  # 89.6%
No temp files left in /tmp after any of the above.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_path.c

@@ -0,0 +1,116 @@
+/*
+ * aksl_realpath -- TODO.md section 1.5.
+ *
+ * The happy paths compare against realpath(3) itself rather than against a
+ * hard-coded string, because $TMPDIR may itself be a symlink (/tmp -> /private/tmp
+ * and friends) and the resolved answer is what the platform says it is.
+ *
+ * Every failure case here passes a *zeroed* resolved_path buffer. That is
+ * deliberate: on failure the wrapper formats resolved_path with %s while
+ * realpath(3) leaves the buffer unspecified (TODO.md 2.1.6), so a test that
+ * passed an uninitialised buffer would be reading uninitialised memory in the
+ * library's own error path. The uninitialised-buffer crash is the defect's own
+ * test to write, not something these should trip over incidentally.
+ *
+ * Also not covered: resolved_path == NULL, which is unchecked today and leaks
+ * the buffer realpath(3) allocates (2.1.6).
+ */
+
+#include "aksl_capture.h"
+
+#include <errno.h>
+#include <limits.h>
+
+static int test_resolves_an_existing_file(void)
+{
+    char path[AKSL_TMP_MAX];
+    char resolved[PATH_MAX];
+    char expected[PATH_MAX];
+
+    AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
+    memset(resolved, 0x00, sizeof(resolved));
+    AKSL_CHECK(realpath(path, expected) != NULL);
+
+    AKSL_CHECK_OK(aksl_realpath(path, resolved));
+    AKSL_CHECK(strcmp(resolved, expected) == 0);
+    AKSL_CHECK(resolved[0] == '/');
+    AKSL_CHECK(unlink(path) == 0);
+    return 0;
+}
+
+/* A symlink resolves to its target, not to itself. */
+static int test_resolves_a_symlink_to_its_target(void)
+{
+    char target[AKSL_TMP_MAX];
+    char link[AKSL_TMP_MAX];
+    char resolved[PATH_MAX];
+    char expected[PATH_MAX];
+
+    AKSL_CHECK(aksl_temp_file(target, sizeof(target)) == 0);
+    AKSL_CHECK(aksl_temp_file(link, sizeof(link)) == 0);
+    /* mkstemp created the link path as a regular file; symlink needs it gone. */
+    AKSL_CHECK(unlink(link) == 0);
+    AKSL_CHECK(symlink(target, link) == 0);
+
+    memset(resolved, 0x00, sizeof(resolved));
+    AKSL_CHECK(realpath(target, expected) != NULL);
+    AKSL_CHECK_OK(aksl_realpath(link, resolved));
+    AKSL_CHECK(strcmp(resolved, expected) == 0);
+
+    AKSL_CHECK(unlink(link) == 0);
+    AKSL_CHECK(unlink(target) == 0);
+    return 0;
+}
+
+static int test_missing_path_reports_enoent(void)
+{
+    char resolved[PATH_MAX];
+
+    memset(resolved, 0x00, sizeof(resolved));
+    AKSL_CHECK_STATUS_MSG_CONTAINS(
+	aksl_realpath("/nonexistent/aksl/path", resolved),
+	ENOENT, "/nonexistent/aksl/path");
+    return 0;
+}
+
+/* A regular file used as a directory component is ENOTDIR, not ENOENT. */
+static int test_non_directory_component_reports_enotdir(void)
+{
+    char path[AKSL_TMP_MAX];
+    char child[AKSL_TMP_MAX + 8];
+    char resolved[PATH_MAX];
+
+    AKSL_CHECK(aksl_temp_file(path, sizeof(path)) == 0);
+    AKSL_CHECK((size_t)snprintf(child, sizeof(child), "%s/child", path)
+	       < sizeof(child));
+
+    memset(resolved, 0x00, sizeof(resolved));
+    AKSL_CHECK_STATUS(aksl_realpath(child, resolved), ENOTDIR);
+    AKSL_CHECK(unlink(path) == 0);
+    return 0;
+}
+
+static int test_rejects_null_path(void)
+{
+    char resolved[PATH_MAX];
+
+    memset(resolved, 0x00, sizeof(resolved));
+    AKSL_CHECK_STATUS_MSG_CONTAINS(aksl_realpath(NULL, resolved),
+                                   AKERR_NULLPOINTER, "path=");
+    return 0;
+}
+
+int main(void)
+{
+    int failures = 0;
+
+    akerr_init();
+
+    AKSL_RUN(failures, test_resolves_an_existing_file);
+    AKSL_RUN(failures, test_resolves_a_symlink_to_its_target);
+    AKSL_RUN(failures, test_missing_path_reports_enoent);
+    AKSL_RUN(failures, test_non_directory_component_reports_enotdir);
+    AKSL_RUN(failures, test_rejects_null_path);
+
+    AKSL_REPORT(failures);
+}