build: enforce the unsafe_code lint in every crate (#1456)

[ajianaz]

What

• Root Cargo.toml: unsafe_code = "forbid" becomes "deny".
• Every crate (uteke-core, uteke-cli, uteke-mcp, uteke-server, docgen) gets [lints] workspace = true, so the level is applied for real.
• The five test modules that call std::env::set_var/remove_var (unsafe in edition 2024) get #[allow(unsafe_code)]: config.rs tests, main.rs resolve_store_tests, uteke-core lib.rs (two modules) and embed/ort_init.rs tests.
• Both copies of the bundled skill and the CHANGELOG now say what is enforced.

Why

The workspace declared forbid but no crate inherited it, so nothing was enforced and the skill's "unsafe_code = "forbid" workspace-wide" claim was untrue. forbid cannot be relaxed per module, so the tests that mutate the environment would not compile; deny plus a scoped allow keeps production code strictly unsafe-free. All 95 existing unsafe blocks are in test modules. Closes #1456.

Testing

• cargo clippy --workspace --all-targets -- -D warnings is clean with the lints inherited.
• A deliberate unsafe block added to non-test code in uteke-mcp fails the build ("usage of an unsafe block"); it was removed afterwards.
• cargo test --workspace: 1086 passed, 0 failed.

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

---

Review powered by cora-code · BYOK · MIT