chore: add #![forbid(unsafe_code)] to safe Rust crates

Adds the forbid(unsafe_code) crate-level attribute to all Rust crates
that do not use unsafe code, hardening the safety guarantee at compile
time.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

praxis/wp_injector/src/lib.rs

@@ -1,6 +1,7 @@
 // WP Praxis Injector Library
 // Core functionality for symbolic injection into WordPress
 
+#![forbid(unsafe_code)]
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 

praxis/wp_praxis_core/src/lib.rs

@@ -20,6 +20,7 @@
 #![deny(unsafe_code)]
 #![warn(missing_docs)]
 
+#![forbid(unsafe_code)]
 pub mod manifest;
 pub mod parser;
 pub mod symbol;

project-wharf/bin/wharf-cli/src/main.rs

@@ -15,6 +15,7 @@
 //! - `wharf gen-keys` - Generate cryptographic keys (DKIM, SSH, TLS)
 //! - `wharf db` - Database configuration commands
 
+#![forbid(unsafe_code)]
 use clap::{Args, Parser, Subcommand};
 use std::path::PathBuf;
 use tracing::{info, Level};

project-wharf/bin/yacht-agent/src/main.rs

@@ -20,6 +20,7 @@
 //! - If it crashes, the site goes offline (better than being hacked)
 //! - Only signed commands from the Wharf are accepted
 
+#![forbid(unsafe_code)]
 use std::net::SocketAddr;
 use std::sync::Arc;
 

project-wharf/xtask/src/main.rs

@@ -7,6 +7,7 @@
 //! - Building the eBPF XDP firewall
 //! - Installing the compiled eBPF object file
 
+#![forbid(unsafe_code)]
 use std::path::PathBuf;
 use std::process::Command;
 

resurrect/src/socp-tui/src/main.rs

@@ -4,6 +4,7 @@
 //! A ncurses-style dashboard for managing multiple web sites
 //! through a centralized, security-hardened control plane.
 
+#![forbid(unsafe_code)]
 mod app;
 mod api;
 mod ui;

sinople-theme/wasm/semantic_processor/src/lib.rs

@@ -18,6 +18,7 @@
 //! const constructs = await processor.query_constructs();
 //! ```
 
+#![forbid(unsafe_code)]
 use wasm_bindgen::prelude::*;
 use serde::{Deserialize, Serialize};
 use sophia_api::graph::Graph;