M15: enforcing what the documents assert

[youhide]

The pass that produced M6, M11, M13 and M14 was reading a document and
checking the code against it. This is the same pass applied to the
invariants rather than the behaviours — the things the documents state
as properties of the project, which nothing was checking.

"A reviewer should be able to audit all unsafe by reading one file"

ARCHITECTURE has said that since before there was code. It was true — and
true by everyone's discipline. Nothing stopped a second unsafe block
appearing in the supervisor or the unit parser.

oxinit now carries #![deny(unsafe_code)] with sys::raw as the single
#[allow], and every crate that should contain none carries
#![forbid(unsafe_code)], which nothing downstream can relax.

Checked rather than assumed — an unsafe block added to reap.rs:

error: usage of an `unsafe` block
error: could not compile `oxinit`

and the same in oxinit-unit.

The two test fixtures keep theirs. Reconstructing an inherited descriptor
is from_raw_fd, which is unsafe by construction, and they are
installed only in a test image.

The MSRV was a promise nothing kept

rust-version = "1.95" is a claim about people on older toolchains, and
CI ran whatever stable was that week — so a dependency bump raising the
real floor would have been discovered by whoever it broke. Verified
locally against 1.95 before adding the job; it builds.

The dependency tree

CLAUDE.md: "The dependency tree of PID 1 is part of its attack surface."
Every dependency's commit message justifies it, and nothing watched them
afterwards. cargo audit on every push, blocking — an advisory against
something inside PID 1 is not a warning to look at later.

Thirty-five crates in the lockfile, none affected today.

One thing actually wrong

tests/ appears in the workspace layout in both CLAUDE.md and
ARCHITECTURE.md and has never existed. The integration tests are the
xtask suites; the directory that does exist and was not listed is
units/.