The new direct Rust file-I/O callback is unsafe because it receives a raw NUL-terminated filename pointer. Add the required safety contract so CLI clippy with `-D warnings` accepts the migrated ABI leaf. Test Plan: - `git diff --cached --check` -- passed. - Capped CLI clippy rerun after this commit.