Add licensing, spelling, and unsafe-documentation gates

[P4suta]

Closes the two baseline gaps that separated this repository from its siblings. Both turned up real findings rather than just adding ceremony.

Licensing and spelling

• Add REUSE.toml and LICENSES/, reaching REUSE 3.3 compliance at 58/58 files. This was the only one of the four Windows crates with no REUSE metadata at all. Annotations are path-based rather than per-file SPDX headers — matching windows-spawn — so no source file needed touching.
• Add _typos.toml and run both tools in a new required Licensing and spelling job. The spell-check found one real misspelling in a CI helper test label (unparseable → unparsable); the helper self-test still passes.
• Ship REUSE.toml and LICENSES/ in the package, as the siblings do.

Unsafe documentation

Deny clippy::undocumented_unsafe_blocks workspace-wide. CONTRIBUTING.md already required a specific safety justification on every unsafe block, and ADR 0003 confines unsafe to src/sys.rs — but nothing enforced either.

Fifteen blocks had no justification:

• Two in production code — RmCancelCurrentTask and RmEndSession, where the argument is that the ended guard serializes the call and the upgraded Arc keeps the session alive across it.
• Thirteen in the hardening tests that deliberately fabricate malformed RM_FILTER_INFO records with out-of-bounds and misaligned strFilename pointers and unterminated strings. That is precisely where the invariants most needed writing down: the reader has to be able to tell "this pointer is bogus on purpose, and the parser must reject it without dereferencing" from an actual defect.

Verification

fmt, clippy -D warnings (with the new lint), test --workspace --all-targets --all-features, test --doc, typos, reuse lint, cargo deny check, and the Dependabot policy self-test all pass locally. cargo package --list confirms the new licensing files ship.

Does not touch #4.