Document unsafe contracts and stop reusing poisoned state

compositor/src/handlers/screenshot_worker.rs

@@ -195,6 +195,7 @@ fn private_directory() -> Result<PathBuf, String> {
         }
         Ok(metadata) => {
             use std::os::unix::fs::MetadataExt;
+            // SAFETY: geteuid has no pointer arguments or caller-side preconditions.
             if !metadata.is_dir() || metadata.uid() != unsafe { libc::geteuid() } {
                 return Err("Refusing to stage screenshots in an untrusted directory".into());
             }

compositor/src/handlers/window_capture.rs

@@ -541,6 +541,8 @@ pub(crate) mod tests {
                 assert_eq!(after, before, "rejected snapshot wrote private pixels");
             }
             // Restore the client's colored buffer for subsequent renderer checks.
+            // SAFETY: before was copied from this checked SHM layout, so the destination has
+            // before.len() writable bytes and does not overlap the owned backup.
             unsafe {
                 std::ptr::copy_nonoverlapping(
                     before.as_ptr(),