fix(security): resolve code-scanning alerts #20, #66, #67, SAST #25 (#134)

- Remove #![allow(clippy::missing_safety_doc)] from runtime/lib.rs
- Add missing # Safety documentation to all unsafe functions in list.rs
- Add justification comment for .unwrap_or() in vram-cache/lib.rs

These changes address:
- Missing safety documentation for unsafe extern C functions
- Unchecked unwrap patterns flagged by SAST scanners
- Code scanning violations for unsafe code without justification

Author: hyperpolymath

src/ephapax-runtime/src/lib.rs

@@ -7,7 +7,6 @@
 //! This provides the memory management primitives used by generated code.
 
 #![cfg_attr(not(feature = "std"), no_std)]
-#![allow(clippy::missing_safety_doc)]
 
 // Additional modules for self-hosting compiler
 pub mod list;

src/ephapax-runtime/src/list.rs

@@ -186,12 +186,20 @@ pub unsafe extern "C" fn __ephapax_list_clear(handle: ListHandle) {
 // ============================================================================
 
 /// Create new empty string list
+///
+/// # Safety
+///
+/// Requires bump allocator to be initialized
 #[no_mangle]
 pub unsafe extern "C" fn __ephapax_string_list_new(initial_capacity: u32) -> ListHandle {
     __ephapax_list_new(initial_capacity)
 }
 
 /// Append string to string list
+///
+/// # Safety
+///
+/// handle must be valid list handle
 #[no_mangle]
 pub unsafe extern "C" fn __ephapax_string_list_append(
     handle: ListHandle,
@@ -201,6 +209,10 @@ pub unsafe extern "C" fn __ephapax_string_list_append(
 }
 
 /// Get string from string list
+///
+/// # Safety
+///
+/// handle must be valid list handle
 #[no_mangle]
 pub unsafe extern "C" fn __ephapax_string_list_get(handle: ListHandle, idx: i32) -> u32 {
     __ephapax_list_get(handle, idx) as u32

src/ephapax-vram-cache/src/lib.rs

@@ -145,6 +145,7 @@ impl VramCache {
 
         // Calculate max entries based on average entry size (estimate 1KB per IR for safety)
         // Use generous limit so we evict based on bytes, not entry count
+        // Safe: (max_size_bytes / 1024).max(1000) is always >= 1000, so try_into::<usize> will succeed
         let max_entries = ((max_size_bytes / 1024).max(1000) as u64)
             .try_into()
             .unwrap_or(10000);