BUGFIX: va_end and panic()

There were two occasions within error-creation routines where an internal
panic() can occur inside a va_start/va_end pair.  These have both been fixed.
error default: fwrite has default.

`error_fwrite` has changed its usage and interface.  It used to be a built-in
implementation for the .fwrite method.  It is now the wrapper that will either
call that method, or else supply a default behaviour.

This means you must not call the method directly - it might be NULL.
`error_fwrite` is called internally by `log_error`, but it is also and external
interface, in case you have your own reasons for writing errors to streams.
SQASH-THIS: log_error checks error_fwrite's return value.
error default: cleanup

If an error type has not .cleanup method (the call back is NULL),  then
destroy_error will simply use `free`.  The means that the default ErrorType is
now exactly blank - you can always use the defaults for everything.
error default: type set in elm_mkerr, not init.

The idea is that the error type is set before the constructor is called, and
the constructor leaves it alone.  This way the same constructor can be used by
multiple types.

Along with this change, we make `elm_mkerr` set all unused fields to 0.  This
reflects a change of emphasis: previously the init_* function was the real
initialisar and `elm_mkerr` was only used instead of malloc() so that we could
sneak in the LINE, FUNCTION and FILE.  Now elm_mkerr is more of a true (if very
low level) initialiser that sets up defaults that the init_* can customise.
error default: ERROR_WITH and ERROR_ALLOC

The meaning of `ERROR_WITH` has now changed.  In the past it used to create an
error of arbitrary type, and would call the correct constructor - assuming you
followed the correct naming convention for constructors.  Now `ERROR_WITH`
always calls `init_error` and therefore should only be used with "simple
custom" errors, which are really the same as a standard error under the hood.

True custom errors should still have their own constuctors, but now the name
is just a convention.  Creating an error is done with

                init_your_error(ERROR_ALLOC(your_error), ....)

Of course, when you define a new error type you should wrap the above up in a
macro.
error default: test_simple_custom_error

This test demonstrates how to define a trivial custom error that actually
behaves just the same as the plain-old-error.
error default: Error documentation.

The Error section in err.h has been totally re-commented and re-ordered
to make the comments both clearer and more up to date.
bug/002: emergency_write returns # of bytes output

This makes it more like other I/O writing functions, and will make it possible
to use it in extreme-event handlers like ENOMEM.
bug/002: Sys panics exits with errno.

elm will now use `errno` as its result code when a system panic is uncaught.
There is also a test for this behaviour.
bug/002: Refactoring elm-fail-run

We have moved some of the errno handling further up into Fail_Runner removed
some repeated code.
bug/002: Catchable enomem.

Out-of-memory errors (anything that calls panic_nomem) now raise a catchable
panic.  This panic is of a new type `nomem_error_type` -- but (at least for
now?) this type is a statically allocated singleton.  And there are various
special cases to make things work reasonably:

1) Any error message is written using `emergency_write` instead of the
   true error logger.  That means it always goes to stderr.

2) `destroy_error` is a no-op for this error type.

3) If a nomem error is untrapped, the program exits with exit code
   ENOMEM.

4) That last is (sort of) a special case of a new feature: SYS_ERROR and
   IO_ERROR also result in errno.
bug/002: ERROR_NOMEM

If you want to report a nomem-style error via a return value instead of a
panic, you can do so using ERROR_NOMEM().  This is for consistency with the
existing PANIC_NOMEM() interface.  Note that MALLOC and ZALLOC will always
use PANIC_NOMEM()
BUGFIX: ZALLOC is gone.

ZALLOC was our wrapper for the standard "calloc".  I call it a "bug" because
the most common use is stupid.  The temptation is to use it to initialise
structs to zero-default.  But this doesn't work on architectures where NULL is
not bytewise equal to the integer zero.  Arcane, and pedantic it's true, but
that explanation is more virtuous than saying "I can't be bothered testing it".
ftr/002: nomem_rescue function.

The user can now set a callback which is called when MALLOC fails on its first
attempt.  Here the user can try to somehow make new memory available.  If the
callback succeeds MALLOC will try again.
panic_nomem returns a value
readme: Update, bug 002 removed.