Centralize unsafe MLIR access and deny unsafe elsewhere

[arniber21]

What to build

Collapse raw MLIR mutation and external-pass context lifetime erasure into one small audited adapter, then enforce an unsafe-by-exception workspace policy. Safe pass implementations should not manipulate integerized pointers or call raw C mutation functions directly.

Acceptance criteria

• One internal module owns external-pass context conversion and raw operation mutation.
• Every unsafe block has a precise SAFETY justification tied to the upstream lifetime or FFI contract.
• Pass implementations use safe adapter methods and contain no repeated pointer-to-integer-to-reference pattern.
• The workspace denies unsafe code by default and allows it only in named audited modules.
• An undocumented-unsafe lint is enabled, and tests cover the safe adapters' failure boundaries.
• Documentation no longer claims a single unsafe boundary unless that claim is mechanically true.

Blocked by

• Make MLIR transformation failures fail closed through Diagnostics #391
• Remove raw analysis sink pointers from TypeChecker #393

[arniber21]

Implemented and merged via PR #459. Closing as complete.