Never crash: steering rules, clippy.toml, forbid unsafe

- AGENTS.md: a "Never crash" section ahead of the asset rules (the rule, why, the bans,
  Result/? patterns, hostile input-derived numbers, bounded recursion, lock poisoning, the
  last-resort guard, a regression test per crash fix), linking craftrules
  standards/never-crash.md. CLAUDE.md and CONTRIBUTING.md point to it.
- clippy.toml: allow unwrap/expect/panic/indexing in tests, so the restriction lints can be
  denied crate by crate without touching test code.
- [workspace.lints.rust] unsafe_code = "forbid" (was "deny"); there is no unsafe or
  allow(unsafe_code) in the workspace.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CONTRIBUTING.md

@@ -24,6 +24,10 @@ cargo xtask ci                           # what every commit must pass
 - **Everything is a command.** New features are engine commands with an id, label, menu path,
   shortcut and parameters, so the UI, the CLI and the MCP server get them at once. Interactive
   widgets register an automation id.
+- **Never crash.** Non-test code returns errors instead of panicking: no `unwrap()`, `expect()`,
+  `panic!`, `unreachable!`, `todo!`, `unimplemented!` or `unsafe`, checked indexing and arithmetic on
+  input-derived values, and a regression test with every crash fix. See the "Never crash" section of
+  [AGENTS.md](AGENTS.md).
 - **Tests with every change**, and green `cargo xtask ci` before every commit. One task per commit.
 
 ## How to add…