Security audit: check unsafe code

[mroczect]

Summary

Audit all crates for unnecessary unsafe blocks and ensure memory safety. The goal is to eliminate or justify every unsafe usage.

Context

Rust guarantees memory safety in safe code. unsafe is sometimes necessary for performance or FFI, but it must be carefully reviewed. This issue tracks the audit process.

Tasks

• Run cargo geiger (or manual grep) to find all unsafe blocks in the workspace.
• For each occurrence:
  • Determine if it is necessary (e.g., FFI, low-level optimization).
  • If unnecessary, replace with safe code.
  • If necessary, add a comment explaining why and include a link to a safety proof.
• Add a CI step that fails if new unsafe code is introduced without a comment (e.g., using #![forbid(unsafe_code)] in crates that don't need it).
• Document the audit results in a SECURITY.md file.

Acceptance Criteria

• No unsafe blocks remain except those explicitly justified and documented.
• cargo geiger shows zero or minimal unsafe usage.
• The audit report is committed.

Dependencies

• All previous phases (the codebase to audit).