redox-driver-sys: add # Safety doc to MEMORY_ROOT_FD static

Documents the safety invariants for the AtomicPtr<()> that caches
the memory scheme root fd for the process lifetime:
- read-only after first init (Ordering::Acquire)
- pointer is either null or a valid fd cast to *mut ()
- cast is valid because we never dereference the pointer; only
  round-trip through libredox::call::dup

This is the first of multiple commits adding # Safety documentation
across the unsafe surfaces of redox-driver-sys.

local/recipes/drivers/redox-driver-sys/source/src/memory.rs

@@ -44,6 +44,13 @@ bitflags::bitflags! {
 // 2. The FD is opened with FD_CLOEXEC — children after exec(2) do not inherit it.
 // 3. This code MUST NOT be used in processes that fork() without exec() —
 //    the child would share the same FD table slot, risking double-close.
+//
+// SAFETY for the `static MEMORY_ROOT_FD: AtomicPtr<()>`:
+//   - The pointer is read-only after first initialization (`Ordering::Acquire`).
+//   - The pointer value is either null (uninitialized) or a valid fd cast to
+//     `*mut ()`. It is never aliased to any other allocation.
+//   - The cast from `usize` (raw fd) to `*mut ()` is valid because we never
+//     dereference the pointer; we only round-trip it through `libredox::call::dup`.
 static MEMORY_ROOT_FD: AtomicPtr<()> = AtomicPtr::new(ptr::null_mut());
 
 fn ensure_memory_root() -> Result<libredox::Fd> {