fix: add unsafe code guardrails

[rickcrawford]

Summary

• Closes WOR-19 by adding #![forbid(unsafe_code)] to crate roots that do not need unsafe.
• Adds an explicit #![allow(unsafe_code)] and inline justification for sbproxy-vault, where volatile zeroization intentionally uses unsafe.
• Updates the unreleased changelog entry for the guardrail.

Test plan

• cargo fmt --all -- --check
• cargo build --workspace
• cargo check --workspace --all-targets
• IDE lints: no linter errors reported for edited crate roots

Made with Cursor