journal: OutboxRelay throws NullSinkError instead of crashing on a null sink (closes morph#95)

[Yaraslaut]

Closes #95: OutboxRelay::relay()'s null-sink path
used to be real UB (a null-pointer virtual dispatch through
sink->append(), confirmed as a process crash) with no seam to test it
portably. Fixes it directly per the issue's first proposed option
(a null sink throws a catchable exception), rather than adding an
observability-only hook that leaves the crash in place.

The fix

relay() now checks sink for null immediately after
logIfAnyDepNull() (which already logs the warning) and before any row
ever reaches sink->append(), throwing a new NullSinkError (a
std::runtime_error, matching this codebase's established
<Domain>Error convention -- SerializationError, FileOfflineQueueError,
ParseError, etc.):

struct NullSinkError : std::runtime_error {
    using std::runtime_error::runtime_error;
};

A null drainOutbox/markRelayed already throws a catchable
std::bad_function_call (invoking a null std::function) -- this makes
sink consistent with that instead of the one member that used to
crash instead of throw. An empty drainOutbox() with a null sink is
still a no-op, unchanged: nothing would touch sink either way.

Deliberate, documented behavior change

Per the issue's own explicit caution ("this changes documented
behavior... needs a deliberate decision, not a silent patch"):
docs/spec/journal/journal.md's OutboxRelay contract section is
updated to state the new throw behavior, replacing "invoking a null
member still throws (std::bad_function_call) or crashes as usual".

Tests

Replaces the block comment in test_outbox.cpp explaining why the
null-sink-reaching-append() case couldn't be tested with a real test:
OutboxRelay::relay(): a null sink reaching a non-empty drain throws NullSinkError, not UB drains one real row with sink still null,
asserts NullSinkError is thrown, and asserts the null-sink warning
still fired.

Verification

Full morph_tests suite: 1047 test cases, 10040 assertions, all
passing (up from 1046/10038 on master). Doxygen doc build
(WARN_AS_ERROR=FAIL_ON_WARNINGS, per CLAUDE.md's CI notes) passes
clean for the new NullSinkError type.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!