fix(host/windows): the staging-dir SID checks document their unsafe blocks

clippy's undocumented_unsafe_blocks (deny) flagged the three blocks that
81039581 introduced: the SAFETY comment sat outside the closure, so
IsValidSid/EqualSid inside it read as undocumented, and from_raw_parts
shared a comment that only covered the GetLengthSid line above it. Windows
host clippy is the only leg that lints this cfg(windows) code, red since.

crates/punktfunk-host/src/windows/install.rs

@@ -159,13 +159,15 @@ fn ensure_admin_only_source(dir: &Path) -> Result<()> {
     let verdict = (|| -> Result<()> {
         rc.ok().context("GetNamedSecurityInfoW(owner + DACL)")?;
         let privileged = privileged_sids()?;
-        // SAFETY: `owner` points into the descriptor returned above and is valid for this scope.
         let is_privileged = |sid: PSID| -> bool {
+            // SAFETY: every `sid` handed in points into the descriptor returned above (or at an
+            // ACE inside it) and is valid for this scope; IsValidSid is itself the probe.
             if sid.is_invalid() || !unsafe { IsValidSid(sid) }.as_bool() {
                 return false;
             }
             privileged
                 .iter()
+                // SAFETY: `sid` passed IsValidSid above; `p` is an owned, length-exact SID copy.
                 .any(|p| unsafe { EqualSid(sid, PSID(p.as_ptr().cast_mut().cast())) }.is_ok())
         };
 
@@ -237,6 +239,7 @@ fn privileged_sids() -> Result<Vec<Vec<u8>>> {
             .with_context(|| format!("ConvertStringSidToSidW({s})"))?;
         // SAFETY: psid is a valid SID; copy it out so the caller owns plain bytes.
         let len = unsafe { GetLengthSid(psid) } as usize;
+        // SAFETY: GetLengthSid just measured exactly `len` readable bytes at `psid`.
         let bytes = unsafe { std::slice::from_raw_parts(psid.0 as *const u8, len) }.to_vec();
         // SAFETY: ConvertStringSidToSidW allocates with LocalAlloc.
         unsafe {