A mirror that aborts on a fatal error still exits 0

[xroche]

hts_main2() returned 0 whatever the mirror did, so a script could not tell a finished mirror from one the engine gave up on halfway. It now returns 3 for a mirror that started and did not finish. This changes an exported API's documented return, which Xavier approved ahead of the work.

By class:

status	what happened
0	the mirror ran to the end; or the caller stopped it (^C, hts_request_stop(), a callback returning 0, WebHTTrack's cancel); or nothing transferred and the session was rolled back to the last good one
3	the engine gave up mid-mirror: a write it cannot retry (a full disk, a cache write failure) or a link table it cannot grow past -#L
1, 255	the command line was refused, or a -#E / -#R cache operation failed. No mirror ran

Not every user-set limit aborts, and that is worth your eye: -#L exits 3 while --max-time and --max-size exit 0, because the caps stop through hts_request_stop(), the same channel as ^C, on the reading that meeting a budget is the outcome asked for while a link cap cuts short work that was asked for. Both the man page and the header say so, since a user who meets one and then the other would otherwise call the status unreliable. (The log calls a capped mirror aborted either way, and stdout says Done. for both, which is #1420.)

3 and not 2, on Xavier's call after review. hts_is_exiting() already returns 2 for the rolled-back session, which exits 0, so 2 would have meant the opposite thing on the other channel and an embedder reading one as the other would get it backwards. 3 is free: hts_main2() only ever returned -1, 0 and 1; main() returns that value and nothing else; exit_xh, which is what hts_is_exiting() hands back, holds only -1, 0, 1 and 2, so the two value spaces are now disjoint rather than merely renumbered. The header and the man page both say the two are separate channels, so a fourth value does not reopen this.

Nine live sites set exit_xh = -1 and all reach that status. Eight already existed; the ninth is added here, because the parser hit the -#L cap at htsparse.c:3182, logged Too many URLs, and returned quietly, while htsAddLink's identical refusal aborted. One limit, two answers. htsserver.c branches on this status to render its error block, which is why an exit the caller asked for stays 0: an abort there would put a red error page on the cancel button. hts_errmsg() was empty on this path, so the abort now fills it; without that the status arrived as a bare * on stderr.

No soname bump, and I do not read this as an ABI break: the signature is unchanged, no installed struct changed shape (the htsopt.h edit is a comment), and HTS_EXIT_MIRROR_ABORTED is a new macro. Only the value a caller reads back moved.

Three tests carry it, all through the constant rather than the literal. 360 asserts the abort across four producers and 0 for a mirror that finishes and one that fits under the link cap, and requires a refused command line to exit 255 exactly. 350 asserts it on its /dev/full arms, including the four #1417 added, and 0 on both its EPIPE and SIGTERM arms. 240 already called its -#L pass an aborted mirror in its own header, so it asserts the abort there and 0 on the dead-server pass, where the session is rolled back rather than left half written. Mutants: reverting the return reds all three files, always aborting reds the clean-mirror control, and widening the check to exit_xh != 0 reds 350's SIGTERM arm. The httpmirror() == 0 branch also sets the status and is live rather than dead, but all six returns behind it are allocation or size-overflow guards, so no black-box arm reaches them.

Done. still goes to stdout for an aborted mirror: that is #1420, whose fix lands on the opt->shell TRANSFER DONE token WinHTTrack and htsserver parse.

Closes #1394