Comprehensive safety, correctness, CI, and test improvements

[AndrewAltimit]

Summary

• Phase 1 -- Critical Safety: PTS overflow protection, frame size overflow checks, seqlock multi-writer detection, GPU fence timeout bounds, video dimension validation
• Phase 2 -- Robustness: DPI scale/playback rate validation, IPC race condition fix, swapchain handle lifecycle fix (OnceCell to Mutex), clock jump detection, audio wall-clock timeout, URL host-based validation
• Phase 3 -- CI/DX: Remove duplicate ci.yml, preserve Docker target cache, test parallelization, fix silent cargo-deny install failure, local pre-commit hooks
• Phase 4 -- Dependency Hygiene: Centralize 6 workspace deps (serde_json, clap, egui, wgpu, winit, once_cell), add openssl ban rule, remove stale advisory
• Phase 5 -- Lint Enforcement: Add undocumented_unsafe_blocks + missing_safety_doc clippy lints with SAFETY comments on all 13 unsafe blocks, CRC error context, exponential backoff in shmem reads
• Phase 6 -- Test Coverage: 33 new tests across itk-protocol (14), itk-shmem (7), itk-sync (12) covering edge cases, boundary conditions, and error paths

25 files changed, 806 insertions, 205 deletions. Full CI passes (107 tests, clean clippy/fmt/cargo-deny).

Test plan

• cargo fmt --all -- --check passes
• cargo clippy --all-targets -- -D warnings passes
• cargo test -- 107 tests pass, 0 failures
• cargo deny check -- advisories, bans, licenses, sources all ok
• Full Docker CI pipeline (docker compose --profile ci) passes

Generated with Claude Code