Should ChannelCount be a sealed trait or marked unsafe?

Hi there, we (Rust group @sslab-gatech) are scanning crates on crates.io for potential soundness bugs. We noticed that `ChannelCount` is a public and safe trait. However in these two methods:

https://github.com/astro/rust-pulse-simple/blob/a2aafc1a607b805d213934d341a4f2fe94a7cd1b/src/lib.rs#L142-L147

https://github.com/astro/rust-pulse-simple/blob/a2aafc1a607b805d213934d341a4f2fe94a7cd1b/src/lib.rs#L178-L184

If a `ChannelCount` implementation overrides `sample_size` and returns a bigger number than expected then this could cause reading out of bounds into data. Or it could cause pulseaudio to write from past the data buffer.

Should `ChannelCount` or the `sample_size` method be marked as `unsafe` and this invariant documented to make sure that this critical property is observed? Alternatively, the `ChannelCount` trait could be [sealed](https://rust-lang.github.io/api-guidelines/future-proofing.html#sealed-traits-protect-against-downstream-implementations-c-sealed) to prevent anyone implementing it externally.

Start in src/lib.rs at the two linked method ranges, lines 142-147 and 178-184, and inspect how ChannelCount and sample_size determine buffer access. Confirm the soundness invariant and assess whether the API should use an unsafe method or a sealed trait. Done means the chosen safety approach is implemented and the invariant is documented.

Written by the indexing model from the issue text.