chore(rust): gate workspace against lock-across-await and undocumented unsafe

Inherits a [workspace.lints] table into all four crates:

- clippy::await_holding_lock (deny): a std::sync Mutex/RwLock guard held
  across .await blocks its Tokio worker and is one step from deadlock.
  Async-aware locking belongs to tokio::sync.
- clippy::await_holding_refcell_ref (deny): same failure mode for
  RefCell guards resumed on an arbitrary worker thread.
- clippy::undocumented_unsafe_blocks (warn): every future unsafe block
  must carry a SAFETY justification; the workspace currently has zero
  unsafe blocks, so this only gates what comes next (free-threading
  work, buffer protocol).
- rustc::unsafe_op_in_unsafe_fn (warn): unsafe operations inside unsafe
  fns need their own explicit unsafe block.

litellm-rust/Cargo.toml

@@ -36,6 +36,14 @@ tokio-tungstenite = { version = "0.24", default-features = false, features = ["c
 futures-util = { version = "0.3", default-features = false, features = ["sink", "std"] }
 base64 = "0.22"
 
+[workspace.lints.rust]
+unsafe_op_in_unsafe_fn = "warn"
+
+[workspace.lints.clippy]
+await_holding_lock = "deny"
+await_holding_refcell_ref = "deny"
+undocumented_unsafe_blocks = "warn"
+
 [profile.release]
 opt-level = 3
 lto = "thin"

litellm-rust/crates/ai-gateway/Cargo.toml

@@ -43,3 +43,6 @@ python-config = ["dep:pyo3"]
 [dev-dependencies]
 futures-channel = "0.3"
 tower = { version = "0.5.3", features = ["util"] }
+
+[lints]
+workspace = true

litellm-rust/crates/core/Cargo.toml

@@ -33,3 +33,6 @@ bedrock-auth = [
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+
+[lints]
+workspace = true

litellm-rust/crates/python-bridge/Cargo.toml

@@ -35,3 +35,6 @@ tokio-tungstenite.workspace = true
 [[bench]]
 name = "serialization"
 harness = false
+
+[lints]
+workspace = true

litellm-rust/crates/python-interop/Cargo.toml

@@ -13,3 +13,6 @@ serde.workspace = true
 [dev-dependencies]
 rstest.workspace = true
 serde_json.workspace = true
+
+[lints]
+workspace = true