unsafe: trust, but verify (yourself)

unsafe opts out of some compiler checks for FFI, raw pointers, and niche optimizations. Keep unsafe blocks tiny and document invariants.

Goal: safe public API, unsafe internals — the Rust way.