build: workspace unsafe_code = "forbid" applies to no crate #1456

What

The root Cargo.toml declares:

[workspace.lints.rust]
unsafe_code = "forbid"

No crate opts in: none of the crates/*/Cargo.toml files has [lints] workspace = true. Cargo only applies workspace lints to members that inherit them, so unsafe_code = "forbid" is enforced nowhere.

The bundled skill (.agents/skills/uteke-memory/SKILL.md lines 8 and 214, plus its copy in crates/uteke-cli/assets/) claims "unsafe_code = "forbid" workspace-wide".

There is real unsafe in the workspace. For example, tests call unsafe { std::env::set_var(..) } (edition 2024), such as crates/uteke-cli/src/main.rs around lines 324-356 and the fallback-settings env test in crates/uteke-core/src/lib.rs. Those would not compile under forbid.

Why

The documented guarantee is not true, and nothing stops unsafe from entering production code.

Found while researching #1327 stage 2.

Possible fix

1. Add [lints] workspace = true to each crate.
2. For test-only set_var, either:
   • use deny at the workspace level plus #[allow(unsafe_code)] on those test helpers, or
   • move env mutation behind a safe test helper.
3. Alternatively, keep forbid for production code only, by using #![forbid(unsafe_code)] in each lib.rs / main.rs and #[cfg(test)]-scoped allows.
4. Correct the skill text to match whatever is enforced.

Testing

• cargo clippy --workspace --all-targets -- -D warnings must pass with the lints inherited.
• A deliberate unsafe {} in non-test code must fail the build.