Document mmap safety

[CraftSpider]

Supercedes #667

Document safety preconditions and reasoning for why they're followed. I'd like to push the unsafety down another level, or just remove the mmap function (make Mmap a common type with sys impls for the platform-specific bits), but those both are a lot more work.