CI/lints: forbid(unsafe_code), missing_docs, cargo-deny, cargo-semver-checks

[martinkersner]

Part of #116 — the Lints / CI hygiene section. Ticks these boxes:

• Add #![forbid(unsafe_code)]
• Add #![warn(missing_docs)]
• Add cargo-deny (or cargo-audit) to CI
• Add cargo-semver-checks to CI

Not in this PR: the API/runtime, naming, and other #116 items.

What changed

src/lib.rs

• #![forbid(unsafe_code)] — the crate has no unsafe; make it a guarantee. Build passes.
• #![warn(missing_docs)] at the crate root. The hand-written code (src/api.rs, src/lib.rs) already fully satisfies it — zero new warnings.
• Added missing_docs to the existing #[allow(...)] on pub mod generated. src/generated.rs is produced by the external datamaxi-codegen tool (DO NOT EDIT) and its Options builder methods carry no doc comments, so a crate-wide missing_docs would flood warnings from generated code. Exempting only that module keeps generated code from blocking CI while holding hand-written code to the standard. Tracked for a real fix (emit docs in codegen) in codegen: emit doc comments on generated Options builders #124, after which the exemption can be removed.

deny.toml + .github/workflows/deny.yml — cargo deny check advisories bans licenses sources on push/PR and weekly. The crate's whole job is network calls and nothing checked the RustSec advisory DB. License allow-list covers every license currently in the dependency tree.

.github/workflows/semver.yml — cargo-semver-checks on PRs. The crate isn't published to crates.io (it ships via git), so there's no registry baseline; the job diffs each PR's public API against the PR base commit (baseline-rev, fetch-depth: 0). The crate went 0.3.3 → 0.12.0 with no mechanical SemVer check.

Test plan

Ran locally (Rust stable, --all-features):

• cargo fmt --all -- --check — clean
• cargo clippy --all-targets --all-features -- -D warnings — clean
• cargo test — 34 unit + 5 doc-tests pass
• cargo build / cargo build --all-features — no missing_docs warnings; forbid(unsafe_code) compiles
• cargo doc --no-deps — no new warnings (pre-existing broken-intra-doc-link warnings in api.rs are unrelated to this PR and present on main)

cargo-deny / cargo-semver-checks aren't installed locally, so those YAMLs are validated by inspection: action inputs checked against each action's action.yml (EmbarkStudios/cargo-deny-action@v2 command; obi1kenobi/cargo-semver-checks-action@v2 baseline-rev / feature-group), deny.toml validated as TOML and written to the cargo-deny 0.16+ schema, and the license allow-list derived from cargo metadata over the actual tree. They will first execute in CI on this PR.

Known failures / caveats

• First semver-checks run compares against the base commit, which equals main; this PR makes no public API change, so it should pass.