fix(host/linux): satisfy clippy -D warnings on the cursor-blend path

The Linux clippy leg has been red since 5249d31d (cursor-as-metadata):
that push was verified fmt-green but the -D warnings clippy step (which
only compiles the Linux/CUDA target) was not. Five findings:

- capture/linux/mod.rs: the spa_meta_bitmap field-read unsafe block had
  no adjacent SAFETY comment (the preceding one documents the pointer
  arithmetic block, not this deref).
- zerocopy/cuda.rs: the cuModuleGetFunction unsafe block's SAFETY comment
  sat before the enclosing closure instead of adjacent to the block.
- zerocopy/cuda.rs: blend_argb/blend_yuv444/blend_nv12 tripped
  too_many_arguments (9/7) — geometry+cursor-size+offset params that a
  struct would only unpack at the call site; allow, matching the crate's
  existing use of the attribute.

Unblocks the 0.12.0 release (main must be green before the tag).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/capture/linux/mod.rs

@@ -1062,6 +1062,8 @@ mod pipewire {
         // requested). The resulting pointer is in bounds and aligned for `spa_meta_bitmap`.
         let bmp =
             unsafe { (cur as *const u8).add(bmp_off as usize) as *const spa::sys::spa_meta_bitmap };
+        // SAFETY: `bmp` is the in-bounds, aligned `spa_meta_bitmap` pointer computed just above; the
+        // producer fully initialized this header, so reading its scalar fields is sound.
         let (vfmt, bw, bh, stride, pix_off) = unsafe {
             (
                 (*bmp).format,

crates/punktfunk-host/src/linux/zerocopy/cuda.rs

@@ -703,10 +703,10 @@ impl CursorBlend {
                 "cuModuleLoadData(cursor_blend)",
             )?;
         }
-        // SAFETY: `module` loaded above; each name is a valid NUL-terminated symbol present in the
-        // module (verified in the .ptx `.entry` list); `&mut f` is a live out-param.
         let getf = |name: &CStr| -> Result<CUfunction> {
             let mut f: CUfunction = std::ptr::null_mut();
+            // SAFETY: `module` loaded above; each name is a valid NUL-terminated symbol present in
+            // the module (verified in the .ptx `.entry` list); `&mut f` is a live out-param.
             unsafe {
                 ck(
                     cuModuleGetFunction(&mut f, module, name.as_ptr()),
@@ -759,6 +759,7 @@ impl CursorBlend {
     }
 
     /// Blend into a packed 4-byte (NVENC ARGB) owned surface at `(ox,oy)`.
+    #[allow(clippy::too_many_arguments)] // surface geometry + cursor size + offset — a struct would just be unpacked at the call
     pub fn blend_argb(
         &self,
         surf: CUdeviceptr,
@@ -789,6 +790,7 @@ impl CursorBlend {
     }
 
     /// Blend into an owned planar YUV444 surface (3 stacked full-res planes) at `(ox,oy)`.
+    #[allow(clippy::too_many_arguments)] // surface geometry + cursor size + offset — a struct would just be unpacked at the call
     pub fn blend_yuv444(
         &self,
         base: CUdeviceptr,
@@ -819,6 +821,7 @@ impl CursorBlend {
     }
 
     /// Blend into an owned NV12 surface (Y plane at `base`, interleaved UV at `base + pitch*h`).
+    #[allow(clippy::too_many_arguments)] // surface geometry + cursor size + offset — a struct would just be unpacked at the call
     pub fn blend_nv12(
         &self,
         base: CUdeviceptr,