chore: add #![forbid(unsafe_code)] to safe Rust crates

Adds the forbid(unsafe_code) crate-level attribute to all Rust crates
that do not use unsafe code, hardening the safety guarantee at compile
time.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

crates/intsoc-api/src/lib.rs

@@ -9,6 +9,7 @@
 //! 1. IETF Datatracker: For document discovery, state tracking, and submission.
 //! 2. IANA Registries: For protocol parameter verification and lookup.
 
+#![forbid(unsafe_code)]
 pub mod datatracker;
 pub mod iana;
 

crates/intsoc-cli/src/main.rs

@@ -9,6 +9,7 @@
 //!   intsoc status <name>      Check submission status
 //!   intsoc init <name>        Initialize a new draft from template
 
+#![forbid(unsafe_code)]
 use clap::{Parser, Subcommand};
 use std::path::PathBuf;
 

crates/intsoc-core/src/lib.rs

@@ -6,6 +6,7 @@
 //! for processing documents across all Internet Society organizations:
 //! IETF, IRTF, IAB, Independent Stream, IANA, and RFC Editor.
 
+#![forbid(unsafe_code)]
 pub mod document;
 pub mod fix;
 pub mod organization;

crates/intsoc-fixer/src/lib.rs

@@ -6,6 +6,7 @@
 //! Internet Society documents. Uses the AutoSafe/Recommended/ManualOnly
 //! classification from the validation framework.
 
+#![forbid(unsafe_code)]
 pub mod diff;
 pub mod engine;
 pub mod generators;

crates/intsoc-git/src/lib.rs

@@ -12,6 +12,7 @@
 //! 2. Build Simplicity: No external C library dependencies (libssh2, openssl, etc.).
 //! 3. Static Binary Support: Enables easy cross-compilation for verified environments.
 
+#![forbid(unsafe_code)]
 use std::path::{Path, PathBuf};
 use thiserror::Error;
 

crates/intsoc-nickel/src/lib.rs

@@ -7,6 +7,7 @@
 //! - `templates/` - Per-stream document templates
 //! - `policies/`  - Submission constraints per organization
 
+#![forbid(unsafe_code)]
 pub mod policy;
 pub mod render;
 

crates/intsoc-parser/src/lib.rs

@@ -5,6 +5,7 @@
 //! Parses RFC XML v3, plain-text Internet-Drafts, and idnits output
 //! into the unified `Document` model.
 
+#![forbid(unsafe_code)]
 pub mod idnits;
 pub mod plain_text;
 pub mod xml;

gui/src-tauri/src/main.rs

@@ -14,6 +14,7 @@
 //! 3. **Conversion**: Provides loss-less mapping between internal 
 //!    Rust enums and frontend-friendly string identifiers.
 
+#![forbid(unsafe_code)]
 use serde::{Deserialize, Serialize};
 use intsoc_core::validation::{CheckCategory, CheckResult, CheckSummary, Fixability, Severity};
 // ... [other imports]