chore: add #![forbid(unsafe_code)] to safe Rust crates

Adds the forbid(unsafe_code) crate-level attribute to all Rust crates
that do not use unsafe code, hardening the safety guarantee at compile
time.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

bin/wharf-cli/src/main.rs

@@ -15,6 +15,7 @@
 //! - `wharf gen-keys` - Generate cryptographic keys (DKIM, SSH, TLS)
 //! - `wharf db` - Database configuration commands
 
+#![forbid(unsafe_code)]
 use clap::{Args, Parser, Subcommand};
 use std::path::PathBuf;
 use tracing::{info, Level};

bin/yacht-agent/src/main.rs

@@ -20,6 +20,7 @@
 //! - If it crashes, the site goes offline (better than being hacked)
 //! - Only signed commands from the Wharf are accepted
 
+#![forbid(unsafe_code)]
 use std::net::SocketAddr;
 use std::sync::Arc;
 

xtask/src/main.rs

@@ -7,6 +7,7 @@
 //! - Building the eBPF XDP firewall
 //! - Installing the compiled eBPF object file
 
+#![forbid(unsafe_code)]
 use std::path::PathBuf;
 use std::process::Command;