Rust rules: unsafe blocks, panic in lib, unwrap in prod

[Krigsexe]

Context

ai-rsk has 0 Rust YAML rules. Rust projects rely on cargo-audit only (Layer 2). Need Layer 1 rules for Rust-specific patterns.

Scope

• unsafe blocks without safety comments
• panic!() / unwrap() / expect() in library code (not binary)
• todo!() / unimplemented!() in non-test code
• #[allow(dead_code)] or #[allow(unused)] (code smell)
• hardcoded secrets in Rust code
• std::process::Command without input sanitization

Acceptance criteria

• Each rule scoped to *.rs
• CWE references verified
• Fixtures in tests/fixtures/