Migrate remaining adjtimex/clock_adjtime unsafe blocks

[mack42]

Context: v0.12.2 eliminated 18 of 41 unsafe blocks. 23 remain, nearly all in the adjtimex/ntp_adjtime/clock_adjtime family.

Remaining unsafe

`crates/rtime-clock/src/unix.rs` (~12 blocks)

`libc::adjtimex`, `libc::ntp_adjtime`, and `std::mem::zeroed::libc::timex()` across probe_adjustable / step_impl / adjust_frequency_impl / frequency_offset_impl for Linux and FreeBSD.

`crates/rtime-clock/src/phc.rs` (~4 blocks)

`libc::clock_adjtime` + zeroed timex for PHC frequency adjustment.

`crates/rtime-net/src/interface.rs` (~6 blocks)

ethtool SIOCETHTOOL ioctl for querying NIC timestamping capabilities; uses custom `Ifreq` struct and zeroed `EthtoolTsInfo`.

`crates/rtime-net/src/multicast.rs` (1 block)

`IP_MULTICAST_IF` setsockopt — nix 0.29 does not expose this as a typed sockopt.

Options

1. Keep as-is — these are all intrinsic to the POSIX clock-adjustment API and the Linux-specific ethtool ioctl. nix does not wrap `adjtimex`/`ntp_adjtime`/`clock_adjtime`.
2. Wrap ourselves — add a tiny internal `clock_adjtime` safe-wrapper crate/module with `Timex` as a `#[repr(C)]` `Default` type and a typed safe call. Reduces visible unsafe to a single audited call site.
3. Upstream to nix — contribute typed wrappers; long-tail effort.

Priority

Low. Code has been security-audited twice (`08f2ff3`, `7e96fce`). No known bugs.