Fail the run when a timezone lookup cannot be carried out - #840

The N-day chart commit moved code in src/native_execution_consumer.cpp,
src/native_execution_consumer.hpp, src/source/pine_strategy_host.cpp,
src/source/pine_scheduler_native.cpp and src/timeframe.cpp, so the file:line
citations of the published pages that point into them went stale, and
scripts/check_doc_anchors.py reported 212 bad anchors.

This commit changes digits only: the line numbers inside file:line citations
of nine pages (145 changed lines, 233 changed numbers) and nothing else. No
sentence, word, content pin or table is edited. The numbers were moved with the
repository's own tools: scripts/check_doc_anchors.py --fix (the cited symbol
sits on exactly one line) and scripts/reanchor_doc_citations.py --ref
360c4ab (a line map from the commit before the N-day chart change, where
the pages were correct). The last six citations, which claim no symbol, were
carried across the same line map by hand: the cited code line is the same text
at its new number. scripts/check_doc_anchors.py reports no bad anchor on the
result, and scripts/check_doc_reverts.py reports nothing, since a re-anchor is
not an edit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Main brings the memory-failure, timezone and setter-error changes. The
conflicts were the Unreleased list in CHANGELOG.md, where both sets of
bullets are kept unchanged, and the line citations of the published pages,
which take main's lines here; the citations are re-anchored in the next
commit by the anchors gate's own fix.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merging main moved code in src/native_execution_consumer.cpp,
src/source/pine_strategy_host.cpp, src/source/pine_scheduler_native.cpp and
the other files the N-day chart change touches, so the file:line citations of
the published pages that point into them went stale, and
scripts/check_doc_anchors.py reported 208 bad anchors on the merge.

This commit changes digits only: the line numbers inside file:line citations
of nine pages (140 changed lines) and nothing else. No sentence, word, content
pin or table is edited. The numbers were moved with the repository's own tools:
scripts/check_doc_anchors.py --fix (the cited symbol sits on exactly one line)
and scripts/reanchor_doc_citations.py --ref e163980 (a line map from main,
where the pages are correct). The last six citations, which claim no symbol,
were carried across by hand: the cited code line is the same text at its new
number (one of them, the cursor constructor, gained a parameter on its line).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The check that accepts a timezone name written in a script looks the
name up in the timezone database with realpath, open and read, and it
treated every failure of those calls as "no such zone". When the process
had no file descriptor or memory left, or a read failed, a valid name
such as America/New_York was refused with pine_timezone_error (class
strategy, not retryable) and TradingView's text for an incorrect
timezone; a database directory that could not be resolved refused every
zone name the same way.

The lookup now tells an absent name from a lookup that could not be
carried out. ENOENT, ENOTDIR, ELOOP, ENAMETOOLONG and EISDIR still mean
that the name denotes no zone file and keep pine_timezone_error. ENOMEM
raises out_of_memory. Every other error raises engine_unclassified_error
with the errno kept and the failed call named in the message. When the
database directory itself cannot be resolved, a missing directory
included, the run fails the same way and the message names the
directory. In this check an interrupted call is tried up to three times,
and a header read that returns fewer than four bytes is continued. Only
the argument check of script timezones raises, through the internal
timezone_lookup_accepted; the installed native_calendar::timezone_accepted
keeps its false result, so its callers, the selected-run admission among
them, refuse as before. A name that is also a complete POSIX definition,
such as EST5EDT, stays accepted when its optional file lookup fails. A
failed lookup is not remembered as an accepted name.

tests/test_timezone_lookup_failure.cpp interposes realpath, open and
read to fail each call of the lookup with each class of error, and
checks the failure code, the errno and the call named in the message,
that the name is looked up again afterwards and a clean run then books
the same trades, that one interrupted call does not change the run, the
file header (wrong magic, end of file, a read split in two), the
database directory, the selected-run admission, and a TZDIR that is not
a directory, where UTC offsets and POSIX definitions still run.

Documentation sentences this change removes or rewrites:
- docs/coverage.md, the pine_str_format_time row: "The message is
  TradingView's text with the engine's bar prefix, `Error on bar N: `,
  or `Error before the first bar: ` when no bar is being executed, and
  the arguments carry `bar_index`." It now begins "The error message for
  a refused name is", after a new sentence on the lookup failures.

The allocation-bound manifest lists one new group, the message string
of the lookup refusal in the native calendar (ceiling 1418 -> 1419,
pinned count 1356 + 63 + 184), and its site inventory is re-emitted.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

A failed void C setter records its failure in the handle's run
consumer. If a handle had no consumer, recording would first allocate
one, and a failure of that allocation would leave only the status,
without the code or the text. That state cannot be reached: the
engine's only constructor binds the consumer, and the native host can
be neither copied nor moved. These tests pin that, and show that the
record survives a second allocation failure, without a change to the
engine.

- Every host type of the test starts with its consumer: storing a
  selected-window descriptor allocates nothing and does not return the
  allocation refusal -4.
- When a setter's own string and then the rendering of the record's bar
  prefix are both refused, the setter's out_of_memory record is read
  without any allocation and its text falls back to "setter failed";
  the next run start fails once with that record and publishes no
  report, and the start after it produces the report of a clean run. A
  setter refusal that carries its own code keeps that code when the
  rendering fails.
- A sweep refuses two, and then three, consecutive allocations starting
  at every allocation index of a configured run (the setters,
  preparation, the bar callbacks and the report). Each injected run ends
  in a typed setup refusal before the first bar, in out_of_memory after
  it, or in a report byte-identical to the clean run, and the sweep
  prints how many refusals each run received: a pair at 256 indexes
  (Debug 258), a triple at 37 (Debug 39); the other 234 end at the first
  refusal.

tests/fail_alloc_seam.hpp gains arm_span(first, count), which refuses
count consecutive allocation attempts, and refusals(), the number of
refusals delivered; arm(nth) is arm_span(nth, 1).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Main brings the description of the current CI job graph in AGENTS.md and
CLAUDE.md. Neither file is touched by this branch, so the merge has no
conflicts and changes nothing else.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Main gained the CI job graph documentation (AGENTS.md and CLAUDE.md);
these changes touch neither file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Main now carries #829's squash merge, whose tree equals the #829 head this
branch already merged, so this merge changes nothing in the tree.

Co-Authored-By: Claude Opus 5.5 <[email protected]>