docs(safety): document the unsafe contract end-to-end

After Opt #2 added six bounded `get_unchecked` blocks per chart, the
project's two "no unsafe" claims (README §"At a glance" + spec §11
rule 12) were stale, and there was no single place answering "how
do I know the unsafe is correct?".

This commit closes both gaps:

- New: docs/004. unsafe-safety-contract.md
  Inventories every unsafe site, names the predicate, names what
  establishes it (codegen-time guarantee), and lists the five
  layered checks (const-eval, debug_assert, miri, mutants, Creusot)
  with current status. Documents what's *not* yet covered (the
  16-of-53 missed mutants in the LCA depth walk are behavior, not
  safety; transition() codegen invariants are still Phase-4 for
  Creusot). Includes a maintenance checklist for future unsafe.

- README points at the doc and gives an honest one-paragraph
  summary instead of "no unsafe".

- Spec rule 12 rewritten from "no unsafe in generated code" to
  "bounded unsafe in generated code, none in user code" with a
  pointer to the audit.

- justfile gains `just safety` — runs const-eval (cargo check),
  debug_assert tests, miri, and mutants in one shot. Mirrors the
  doc's audit matrix so the doc never goes stale silently.

justfile

@@ -151,6 +151,33 @@ audit:
     cargo audit
     @echo "✅ Security checks passed"
 
+# Run the full unsafe-audit matrix: const-eval at build, debug_assert!
+# in debug tests, Miri for UB, mutants on the safety-relevant codegen.
+# Mirrors the audit described in `docs/004. unsafe-safety-contract.md`.
+[script]
+safety:
+    echo "🔒 Unsafe safety audit"
+    echo ""
+    echo "1/4 — Compile-time const-eval (any out-of-range table entry"
+    echo "      fails cargo check with E0080)..."
+    cargo check --workspace --all-targets
+    echo ""
+    echo "2/4 — Runtime debug_assert! in dev tests (every unsafe site"
+    echo "      checks its bound on every dispatch)..."
+    cargo nextest run --workspace --no-default-features
+    cargo nextest run --workspace --features tokio
+    echo ""
+    echo "3/4 — Miri (UB detector under interpreted Rust)..."
+    just miri
+    echo ""
+    echo "4/4 — Mutation testing on safety-relevant codegen fns..."
+    cargo mutants -p hsmc-macros \
+        -F "compute_transition_paths|compute_terminate_paths|compute_event_dispatch" \
+        --jobs 4 --no-shuffle
+    echo ""
+    echo "✅ Unsafe audit complete. See docs/004. unsafe-safety-contract.md"
+    echo "   for which checks cover which failure modes."
+
 # Run Miri for UB detection (auto-installs nightly + miri component if missing).
 [script]
 miri: