Move outstanding work from TODO.md into the issue tracker

Twenty-six issues on source.starfort.tech/andrew/libakstdlib, labelled by kind
and blast radius and milestoned by what they can land in: 0.2.x for anything
that breaks no ABI, 0.3.0 for new public symbols, 1.0.0 for the large surfaces.
Everything filed carries status::grooming.

The four items blocked on libakerror are filed in both places -- the fix is
there and the bill is here -- and TODO.md keeps a table saying which is which.

What stays in TODO.md is what a tracker has no place for: where the library
stands, why six libc functions are deliberately not wrapped, which eight
uncovered lines are uncoverable rather than untested, and the akbasic call
counts that prioritised everything built since. 377 lines to 189.

Filed alongside: 25 file headers in tests/ and src/ cite TODO.md section
numbers from a numbering the file itself had already abandoned. They label
completed work, so nothing about the code is misleading -- only the pointer is.
Left for its own commit rather than churning 25 files here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Andrew Kesterson <andrew@aklabs.net>

README.md

@@ -56,7 +56,7 @@ error reporting is not.
 
 There is no TSan test here because there is nothing to verify — the answer is
 known and it is "no". Fixing it means locking or thread-local storage in
-libakerror's pool, which is that library's decision to make; `TODO.md` §1.9
+libakerror's pool, which is that library's decision to make; issue #2
 records it. Until then: confine libakstdlib calls to one thread, or serialise
 them yourself.
 
@@ -100,7 +100,7 @@ copy in your build directory; change the template or `project()`.
 It is `0.x` deliberately. The 0.1 → 0.2 bump was itself an ABI break — fixing the
 confirmed defects changed five signatures and the `ato*` contract, all of it
 listed in `UPGRADING.md` — and the API is not being promised until the wishlist
-in `TODO.md` §3 has settled. While the major version is `0`, **the soname carries
+in the tracker has settled. While the major version is `0`, **the soname carries
 `MAJOR.MINOR`**: 0.1 and 0.2
 are different ABIs and the loader will not substitute one for the other. At 1.0
 the soname becomes `MAJOR` alone — the `if(PROJECT_VERSION_MAJOR EQUAL 0)` in
@@ -225,10 +225,10 @@ of them invert the meaning of "Passed":
 |---|---|
 | `AKSL_TESTS` | Ordinary tests. Must exit 0. |
 | `AKSL_WILL_FAIL_TESTS` | Expected to abort by design — an unhandled error reaching `FINISH_NORETURN`, or a deliberate contract violation. Marked `WILL_FAIL`, so a non-zero exit is a pass. |
-| `AKSL_KNOWN_FAILING_TESTS` | Assert the *correct* behaviour of a confirmed defect (see `TODO.md` §2.1). Also marked `WILL_FAIL`. |
+| `AKSL_KNOWN_FAILING_TESTS` | Assert the *correct* behaviour of a confirmed defect (see `UPGRADING.md`). Also marked `WILL_FAIL`. |
 
 **Both of those lists are currently empty**, which is the news: all six confirmed
-defects in `TODO.md` §2.1 are fixed, and the four tests that used to sit in
+defects recorded in `UPGRADING.md` are fixed, and the four tests that used to sit in
 `AKSL_KNOWN_FAILING_TESTS` are folded back into the tests for the things they
 test, where they now have to keep passing rather than keep failing visibly. The
 mechanism stays for the next one. When a defect is fixed its known-failing test
@@ -322,7 +322,7 @@ so a top-level `-DAKSL_COVERAGE=ON` build would collide on the name and fail to
 configure at all. `CMakeLists.txt` renames the dependency's to `akerror_coverage`
 on the way past — it drives its own instrumented build tree, so
 `cmake --build build-coverage --target akerror_coverage` still works. The
-workaround goes away when libakerror namespaces it upstream; see `TODO.md` §2.3.
+workaround goes away when libakerror namespaces it upstream; see issue #4.
 
 CTest hides the output of a passing test, so `coverage_report` also writes
 `build-coverage/coverage-summary.txt` (the same text report) and
@@ -379,7 +379,7 @@ lines are uncovered and each is uncovered on purpose:
 - **Two in `aksl_fread`/`aksl_fwrite`**, the short transfer with *neither* `feof`
   nor `ferror` set. Every way of producing a short transfer on Linux sets one or
   the other; the branch is there because the standard permits neither, not
-  because anything reaches it. `TODO.md` §1.2 records it as still open.
+  because anything reaches it. Issue #6 records it as still open.
 
 Branch coverage sits far below line coverage because most branches in these files
 are inside the `FAIL_*`/`ATTEMPT`/`FINISH` macro expansions — pool exhaustion,