fix(hypatia): scoped exemption for the unsatisfiable unsafe_block rule (#147)

Follow-up to #146 — the one finding that survived. hypatia's
`unsafe_block` rule is a bare `unsafe\s*\{` regex
(`lib/rules/code_safety.ex`): it flags every unsafe block regardless of
documentation, so no SAFETY comment can ever satisfy it (the adjacency
fix in #146 was a no-op against a rule that never looks). The single
unsafe block in my-llvm is mandatory (inkwell declares `build_gep`
unsafe) and fully documented, so this uses the same scoped
`.hypatia-ignore` mechanism as the existing `coq_axiom`/`transmute`
keyword-match exemptions — a permanent fact should not be expiring
baseline debt. Upstream rule fix is a candidate for hypatia itself.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.hypatia-ignore

@@ -99,3 +99,13 @@ security_errors/secret_detected:docs/wiki/guides/getting-started.md
 # GetElementPtr pointer invariant. `grep -nE 'transmute\s*(::<|\()'` over the file
 # returns nothing. No unchecked bit-reinterpretation exists here.
 code_safety/transmute:crates/my-llvm/src/lib.rs
+
+# --- Rule cannot be satisfied: `unsafe_block` is a bare `unsafe\s*\{` regex
+# (hypatia lib/rules/code_safety.ex) — it flags EVERY unsafe block regardless
+# of documentation; the "requires SAFETY comment" in its description is not
+# actually checked. The single unsafe block here is mandatory (inkwell declares
+# `build_gep` unsafe) and carries a 17-line SAFETY invariant argument plus an
+# adjacent `// SAFETY:` marker. Until the rule checks for SAFETY comments
+# (upstream fix candidate), a scoped exemption is the only correct mechanism —
+# a baseline entry would just regenerate as expiring debt for a permanent fact.
+code_safety/unsafe_block:crates/my-llvm/src/lib.rs