Remote SAM3 worker: crate lint attributes; document the trust boundary

The worker binary gets the never-crash deny list and forbid(unsafe_code) like
every production crate root. docs/ai-masks.md spells out who can reach the
unauthenticated loopback listener.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/segment/src/bin/lightcraft-sam3-worker.rs

@@ -1,3 +1,8 @@
+//! Serves SAM 3 on this Mac's Metal GPU to one LightCraft editor over a loopback socket (an SSH
+//! tunnel); see docs/ai-masks.md → Remote Metal inference.
+#![forbid(unsafe_code)]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let mut args = std::env::args().skip(1);
     let dir = args.next().ok_or("usage: lightcraft-sam3-worker MODEL_DIR [127.0.0.1:8793]")?;

docs/ai-masks.md

@@ -68,7 +68,10 @@ stay in the local library, so later adjustments and exports work without the con
 The worker requires Metal and accepts one editing connection at a time. It loads weights
 on demand and releases them when the client disconnects or remains idle for ten minutes.
 Both endpoints require loopback addresses: SSH provides authentication and encryption.
-The listener has no independent authentication; do not expose it through a public proxy.
+The listener has no independent authentication; do not expose it through a public proxy. Any
+process of any user on the worker Mac can connect to it, and on the editing computer a local
+process listening on the port while the tunnel is down receives the rendered model input, so use
+this only on machines whose local users you trust.
 
 No local weights are required in remote mode. An unavailable worker produces an explicit
 error, not a silent CPU fallback. Restore the tunnel and retry. Unset