chore: add #![forbid(unsafe_code)] to safe Rust crates

Adds the forbid(unsafe_code) crate-level attribute to all Rust crates
that do not use unsafe code, hardening the safety guarantee at compile
time.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

crates/capability/src/lib.rs

@@ -14,6 +14,7 @@
 //!    the previous hash, ensuring that any tampering with the system 
 //!    history is detectable via formal verification.
 
+#![forbid(unsafe_code)]
 mod dir_capability;
 mod audit_log;
 

crates/fs_ops/src/lib.rs

@@ -14,6 +14,7 @@
 //! 3. **Isolation**: All paths are resolved through a `DirCapability`, 
 //!    eliminating path traversal vulnerabilities at the capability layer.
 
+#![forbid(unsafe_code)]
 mod transaction;
 
 pub use transaction::{FsTransaction, FsError, FsOp};

crates/git_ops/src/lib.rs

@@ -12,6 +12,7 @@
 //! 3. **Bitemporal Logic**: Support tracking changes across both the Index 
 //!    and the Working Tree.
 
+#![forbid(unsafe_code)]
 use std::path::Path;
 use git2::{Repository, StatusOptions};
 use serde::{Deserialize, Serialize};

crates/polysafe_nifs/src/lib.rs

@@ -16,6 +16,7 @@
 // ... [Rustler attribute macros and NIF declarations]
 
 // NIF DISPATCH: Routes Elixir calls to the underlying Rust crates.
+#![forbid(unsafe_code)]
 /*
 rustler::init!(
     "Elixir.PolysafeGitfixer.Native",