fix(cli): document stdin callback safety contract

The new direct Rust file-I/O callback is unsafe because it receives a raw
NUL-terminated filename pointer. Add the required safety contract so CLI
clippy with `-D warnings` accepts the migrated ABI leaf.

Test Plan:
- `git diff --cached --check` -- passed.
- Capped CLI clippy rerun after this commit.

rust/cli/src/lib.rs

@@ -36,6 +36,11 @@ use std::ffi::c_void;
 use std::os::raw::{c_char, c_int};
 
 /// Match the C `--list` stdin callback without crossing any file-I/O state.
+///
+/// # Safety
+///
+/// `file_name` must point to a valid NUL-terminated C string, as required by
+/// the original C callback contract. `_opaque` is ignored.
 #[cfg(feature = "cli")]
 #[no_mangle]
 pub unsafe extern "C" fn FIO_listFileIsStdin(