Tighten logfwd-core to no_std + forbid(unsafe_code) #267

Summary

After all impure code is moved out, add structural enforcement to logfwd-core.

Steps

1. Add #![no_std] and extern crate alloc to src/lib.rs
2. Add #![forbid(unsafe_code)] (or via Cargo.toml lints)
3. Replace any remaining std:: imports with core:: / alloc::
4. Replace get_unchecked in ChunkIndex with safe indexing (measure perf impact)
5. Configure strict clippy lints in Cargo.toml
6. Add CI step: cargo build -p logfwd-core --target thumbv6m-none-eabi
7. Add dependency allowlist check in CI
8. Verify memchr works with default-features = false

Cargo.toml lints

[lints.rust]
unsafe_code = "forbid"
missing_docs = "warn"
unused_must_use = "deny"

[lints.clippy]
pedantic = { level = "warn", priority = -1 }
unwrap_used = "deny"
expect_used = "deny"
panic = "deny"
indexing_slicing = "deny"

Dependencies

Depends on #Phase1a, #Phase1b, #Phase1c completing. This is the final step that locks down core.

Assignability

Needs review — the no_std migration may uncover hidden std dependencies. The get_unchecked → safe indexing change needs perf measurement. Copilot can do the mechanical parts but someone needs to verify the perf impact and handle any compilation issues.

Parent: #262