fix: comment unsafe blocks + better harden 1 block

[reubeno]

• Enables clippy rule that requires unsafe code blocks be annotated with SAFETY: comments.
• Adds missing SAFETY comments.
• Adds additional hardening check to the confstr wrapper (found in code review).

[github-actions]

Test Results

    3 files     23 suites   6m 30s ⏱️
  945 tests   945 ✅ 0 💤 0 ❌
2 815 runs  2 815 ✅ 0 💤 0 ❌

Results for commit 90c49ad.

♻️ This comment has been updated with latest results.

[github-actions]

Performance Benchmark Report

Benchmark name	Baseline (μs)	Test/PR (μs)	Delta (μs)	Delta %
clone_shell_object	17.89 μs	17.60 μs	-0.29 μs	🟢 -1.62%
eval_arithmetic	0.15 μs	0.15 μs	0.00 μs	⚪ Unchanged
expand_one_string	1.96 μs	1.91 μs	-0.06 μs	⚪ Unchanged
for_loop	22.43 μs	22.46 μs	0.03 μs	⚪ Unchanged
function_call	2.58 μs	2.48 μs	-0.11 μs	🟢 -4.11%
instantiate_shell	58.93 μs	58.78 μs	-0.15 μs	⚪ Unchanged
instantiate_shell_with_init_scripts	24019.01 μs	24017.78 μs	-1.23 μs	⚪ Unchanged
parse_bash_completion	2032.28 μs	2050.24 μs	17.96 μs	🟠 +0.88%
parse_sample_script	2.05 μs	1.98 μs	-0.07 μs	🟢 -3.65%
run_echo_builtin_command	16.03 μs	16.25 μs	0.22 μs	⚪ Unchanged
run_one_external_command	2494.73 μs	2020.43 μs	-474.31 μs	🟢 -19.01%
tokenize_sample_script	3.47 μs	3.52 μs	0.04 μs	⚪ Unchanged

Code Coverage Report: Only Changed Files listed

Package	Base Coverage	New Coverage	Difference
brush-core/src/jobs.rs	🔴 43.58%	🔴 37.16%	🔴 -6.42%
brush-core/src/sys/unix/fs.rs	🟠 68.13%	🟠 65%	🔴 -3.13%
Overall Coverage	🟢 71.12%	🟢 71.02%	🔴 -0.1%

Minimum allowed coverage is 70%, this run produced 71.02%

Test Summary: bash-completion test suite

Outcome	Count	Percentage
✅ Pass	1339	63.49
❗️ Error	217	10.29
❌ Fail	184	8.72
⏩ Skip	354	16.79
❎ Expected Fail	14	0.66
✔️ Unexpected Pass	1	0.05
📊 Total	2109	100.00