chore(safety): hoist the unsafe lints into the workspace tables (WP2c hoist)

undocumented_unsafe_blocks joins unsafe_op_in_unsafe_fn in
[workspace.lints], and the ~100 scattered per-file #![deny(...)] attributes
(85 files) are deleted — a new crate, or a new module in an old one, is now
covered on creation rather than on remembering. The per-file form is how
pf-vkhdr-layer, wdk-probe and half of pf-clipboard stayed uncovered.

There are THREE workspaces, so the claim is made three times: the main
Cargo.toml, packaging/windows/drivers (workspace table + [lints]
workspace = true in all seven members), and packaging/windows/pf-vkhdr-layer
(its [lints] table, previous commit). pf-update now opts into workspace
lints; the two vendored member snapshots (cros-codecs, usbip-sim) stay out
deliberately and now both say so.

Newly-covered fallout was two link-sanity tests (pyrowave-sys, libvpl-sys)
— proofs written. Stale prose that claimed the workspace held
unsafe_op_in_unsafe_fn at "warn" (it has been deny) or pointed at the
deleted attributes is corrected.

nvenc_core.rs is carved OUT of the unsafe_op_in_unsafe_fn fence: its
exemption rationale ("raw entry-table calls almost line for line") was
false — the file makes zero FFI calls. Its unsafe surface is C-union writes
whose soundness hangs on which codec arm is active, and its own 4:4:4 note
records the shipped bug (hevcConfig bytes stamped onto an AV1 config) that
per-operation blocks make visible. It now runs the strictest discipline in
the crate: clippy::multiple_unsafe_ops_per_block at deny, one union access
per block, each naming its codec guard.

Verified here: cargo fmt clean in all three workspaces; native clippy
-D warnings clean for everything that compiles on macOS (the three
pre-existing mac-native failures — pf-client-core wol.rs, pf-encode
dead-code/closure-call, probe mic_burst — reproduce on the clean tree).
Linux/Windows legs ride the .25/.133 gate.

packaging/windows/drivers/Cargo.toml

@@ -15,6 +15,17 @@ version = "0.0.1"
 license = "MIT OR Apache-2.0"
 publish = false
 
+# The same unsafe discipline as the main workspace (see its Cargo.toml for the full rationale).
+# Restated here because THIS IS A SEPARATE WORKSPACE: the main tree's [workspace.lints] does not
+# reach these crates, so any "workspace-wide" lint claim has to be made here too or it is false
+# for the driver surface. Every member opts in with `[lints] workspace = true`.
+# (`unsafe_op_in_unsafe_fn` is already the edition-2024 default; deny pins it explicitly.)
+[workspace.lints.rust]
+unsafe_op_in_unsafe_fn = "deny"
+
+[workspace.lints.clippy]
+undocumented_unsafe_blocks = "deny"
+
 [workspace.dependencies]
 wdk = "0.4.1"
 wdk-sys = "0.5.1"

packaging/windows/drivers/pf-gamepad/Cargo.toml

@@ -32,3 +32,6 @@ pf-umdf-util.workspace = true
 default = ["hid"]
 hid = ["wdk-sys/hid"]
 nightly = ["wdk-sys/nightly", "wdk/nightly"]
+
+[lints]
+workspace = true

packaging/windows/drivers/pf-gamepad/src/lib.rs

@@ -16,8 +16,6 @@
 
 #![allow(non_snake_case, non_upper_case_globals, clippy::missing_safety_doc)]
 // Every remaining `unsafe {}` (all WDF setup FFI) must carry a `// SAFETY:` proof.
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
 
 use core::sync::atomic::{AtomicPtr, AtomicU32, Ordering};
 

packaging/windows/drivers/pf-mouse/Cargo.toml

@@ -30,3 +30,6 @@ pf-umdf-util.workspace = true
 default = ["hid"]
 hid = ["wdk-sys/hid"]
 nightly = ["wdk-sys/nightly", "wdk/nightly"]
+
+[lints]
+workspace = true

packaging/windows/drivers/pf-mouse/src/lib.rs

@@ -23,8 +23,6 @@
 
 #![allow(non_snake_case, non_upper_case_globals, clippy::missing_safety_doc)]
 // Every remaining `unsafe {}` (all WDF setup FFI) must carry a `// SAFETY:` proof.
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
 
 use core::sync::atomic::{AtomicPtr, AtomicU32, Ordering};
 

packaging/windows/drivers/pf-umdf-util/Cargo.toml

@@ -15,3 +15,6 @@ description = "punktfunk UMDF driver util: safe shared-memory + sealed-channel +
 [dependencies]
 wdk-sys.workspace = true
 pf-driver-proto.workspace = true
+
+[lints]
+workspace = true

packaging/windows/drivers/pf-umdf-util/src/lib.rs

@@ -19,12 +19,9 @@
 //!   `pf_gamepad`/`pf_mouse` tell the host, over the device stack, which process is serving this
 //!   devnode. That is what the host trusts instead of the LocalService-writable bootstrap mailbox.
 //!
-//! Lint gates (mirrored in every driver crate, enforced by the drivers CI clippy step):
-//! `unsafe_op_in_unsafe_fn` + `clippy::undocumented_unsafe_blocks` — every remaining `unsafe {}`
-//! must carry a `// SAFETY:` proof.
-
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
+//! Lint gates (workspace-wide via this workspace's `[workspace.lints]`, enforced by the drivers
+//! CI clippy step): `unsafe_op_in_unsafe_fn` + `clippy::undocumented_unsafe_blocks` — every
+//! remaining `unsafe {}` must carry a `// SAFETY:` proof.
 
 pub mod channel;
 pub mod hid;

packaging/windows/drivers/pf-vdisplay/Cargo.toml

@@ -42,3 +42,6 @@ features = [
     "Win32_Graphics_Dxgi",
     "Win32_Graphics_Dxgi_Common",
 ]
+
+[lints]
+workspace = true

packaging/windows/drivers/pf-vdisplay/src/lib.rs

@@ -14,8 +14,6 @@
 // proof. An IddCx display driver is inherently FFI-bound (D3D11 / IddCx DDIs / cross-process shared
 // textures), so it can't be unsafe-FREE the way the gamepad drivers now are (their logic moved onto the
 // safe `pf_umdf_util` layer); these gates make it unsafe-AUDITED instead, and stop it regressing.
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
 
 #[macro_use]
 mod log;

packaging/windows/drivers/pf-xusb/Cargo.toml

@@ -29,3 +29,6 @@ pf-umdf-util.workspace = true
 [features]
 default = []
 nightly = ["wdk-sys/nightly", "wdk/nightly"]
+
+[lints]
+workspace = true

packaging/windows/drivers/pf-xusb/src/lib.rs

@@ -22,8 +22,6 @@
 
 #![allow(non_snake_case, non_upper_case_globals, clippy::missing_safety_doc)]
 // Every remaining `unsafe {}` (all WDF setup FFI) must carry a `// SAFETY:` proof.
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
 
 use core::sync::atomic::{AtomicBool, AtomicPtr, AtomicU32, Ordering};
 use pf_driver_proto::gamepad::XusbShm;

packaging/windows/drivers/wdk-iddcx/Cargo.toml

@@ -12,3 +12,6 @@ publish = false
 
 [dependencies]
 wdk-sys = { workspace = true, features = ["iddcx"] }
+
+[lints]
+workspace = true

packaging/windows/drivers/wdk-iddcx/src/lib.rs

@@ -12,8 +12,6 @@
 #![allow(non_snake_case, clippy::missing_safety_doc)]
 // P0 lint (audit §8): require explicit `unsafe {}` blocks inside `unsafe fn`s + a `// SAFETY:` proof on
 // each (this crate is the IddCx DDI dispatch layer — inherently unsafe, so audited, not unsafe-free).
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
 
 pub use wdk_sys::iddcx;
 

packaging/windows/drivers/wdk-probe/Cargo.toml

@@ -27,3 +27,6 @@ wdk.workspace = true
 # do its WDF/DXGI types resolve to wdk-sys's (so the generated module compiles)?
 wdk-sys = { workspace = true, features = ["iddcx"] }
 pf-driver-proto.workspace = true
+
+[lints]
+workspace = true

packaging/windows/drivers/wdk-probe/src/lib.rs

@@ -5,8 +5,6 @@
 //! shared `pf-driver-proto` ABI crate (no_std + bytemuck) across the workspace boundary.
 
 #![allow(non_snake_case)]
-#![deny(unsafe_op_in_unsafe_fn)]
-#![deny(clippy::undocumented_unsafe_blocks)]
 
 mod iddcx_rt;
 mod iddcx_surface_assert;