fix(types): make `unsafe` a real checked boundary

Problem

The parser drops the unsafe keyword and keeps the body as a plain block, so raw pointer dereferences and FFI calls are allowed anywhere. packages/safety/src/unsafe_blocks.zig would enforce this, but it imports a non-existent ../ast/ast.zig, uses the old ArrayList API and is not in build.zig.

Evidence (origin/main @ d4b219507)

• packages/parser/src/parser.zig:3860-3877
• packages/safety/src/unsafe_blocks.zig:2-4

Scope

• Keep an UnsafeBlock node (or flag) in the AST.
• Checker: raw-pointer deref, pointer arithmetic, FFI/extern calls and unsafe fn calls are errors outside unsafe.
• Port or delete packages/safety/src/unsafe_blocks.zig.

Acceptance criteria

• Deref of a raw pointer outside unsafe is an error; inside it is accepted.
• The kernel corpus builds (with unsafe added or an explicit allowlist).

Links

Depends on: #778 Part of #814.

Landed 6b2e743f0 (fix(types): enforce unsafe operation boundaries (#787)) on main.

This batch makes unsafe explicit in the AST/parser and enforces checked boundaries in the authoritative type checker for raw-pointer dereference, raw-pointer arithmetic, extern calls, and unsafe-function calls. It also distinguishes raw *T pointers from safe &T references without changing the public reference-type ABI.

Verification: the focused type-checker suite passes 62/62 through the WASI runner with no leak report; guarded peak tree footprint was 580 MB. The issue remains open for retiring the obsolete duplicate safety prototype and completing the kernel-corpus acceptance check.

Follow-up landed on main: b3be98ccb (chore(safety): retire duplicate unsafe prototype (#787)).

Removed the disconnected 345-line packages/safety/src/unsafe_blocks.zig prototype, changed the safety package test script to its real test target, and documented that unsafe-boundary enforcement is owned by the authoritative type checker. Compile-only verification of packages/safety/tests/safety_test.zig passed under a 1 GB guard. The native test runner itself hit the known 120-second macOS startup hang without diagnostics or memory growth, so no runtime-pass claim is being made from that invocation.

#787 remains open pending the kernel corpus acceptance check.

Kernel-corpus acceptance advanced via #823 and 26722c5cb.

The real home-os entry (kernel/src/main.home) previously stopped before unsafe-boundary validation because every quoted import ending in .home was searched with a duplicate extension. After the resolver fix, all 135 root import failures are gone and the compiler reaches 27 semantic type errors. This confirms the checked-unsafe implementation is no longer hidden behind root import resolution, but #787 remains open until the corpus type-checks/builds cleanly.

Kernel-corpus acceptance advanced again via #824 and 97d8262d8.

Home now recognizes its documented never bottom type and permits diverging expressions in any value context. Against the current archived home-os origin/main kernel tree, the semantic error count fell from 87 to 82, removing five valid never signature failures. #787 remains open for the remaining corpus errors.

Reflection builtin result typing landed directly on main as a5e7f84 (#825). The checker now preserves explicit and contextual result types for casts and pointer/integer reflection builtins instead of collapsing them to void. Focused suite: 68/68 passed; guarded no-JSC compiler build passed. On the current archived home-os origin/main kernel corpus, semantic failures dropped from 82 to 31.

Typed undefined storage is complete on main via #826 (eafec92, ca905a5, d7c4a74). Null and undefined are distinct through parsing, checking, and all three native lowering paths; uninitialized reads are diagnosed and no backend manufactures a zero initializer. Focused parser/AST/checker/codegen suites all pass. The current archived home-os origin/main corpus improved from 31 to 21 semantic failures.

Exported module binding visibility landed directly on main as 5af74c0 (#827). Parser and checker regressions pass, and the current home-os origin/main corpus improved from 21 to 17 semantic failures by resolving AML_TEST_CHECKS, AML_INTERP_CHECKS, FLOAT_TEST_CHECKS, and DEV_TYPE_BLOCK through their import namespaces.

Kernel-corpus diagnostics advanced via #833 and e067a90cb. Home had been silently treating absent imported namespace calls as void, which hid most source API mismatches behind a smaller set of downstream type errors. The final guarded audit now reports the real boundary cleanly: 27 missing exports and 4 raw-pointer dereferences outside unsafe, with zero synthetic void mismatches. Examples include scheduler.get_current_pid versus exported scheduler_get_current_pid, absent foundation.read_cr2 / serial_write_hex64, and syscall.syscall_dispatch versus syscall_handler.

The compiler fix and complete type-system tests pass; #787 remains open because home-os must still correct those source API calls and add explicit unsafe blocks.