Claude review: gpu: nova-core: mm: Add multi-page mapping API to VMM

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the most complex and important patch. Several observations:

1. **Per-page PDE walk in prepare phase**: `ensure_pte_path()` is called per-VFN in `prepare_map()`. For a large mapping, this re-walks from the root for each page. The RBTree of prepared pages helps avoid duplicate allocations, but the repeated root-to-leaf walks are O(N * depth). Consider optimizing by tracking the last-resolved PTE table and short-circuiting if consecutive VFNs share the same PTE page.

2. **`MustUnmapGuard` uses `Cell<bool>`**: This is fine for the current single-threaded usage but won't work if `MappedRange` is ever sent across threads. Consider `AtomicBool` or documenting the `!Sync` constraint.

3. In `execute_map()`, the cursor iteration over `pt_pages`:
```rust
let mut cursor = self.pt_pages.cursor_front_mut();
while let Some(c) = cursor {
    let (next, node) = c.remove_current();
```
This drains all prepared pages, not just those for the current mapping. If multiple mappings were prepared before executing, this would install pages for all of them. The comment says "Shared by all pending maps in the `Vmm`, thus preventing races" which addresses this, but it means `execute_map()` must be called serially, one prepared mapping at a time. This constraint should be more prominently documented.

4. **Page table page leak on error**: If `execute_map()` fails partway through (e.g., after installing some PDEs but before writing all PTEs), the partially-installed PDEs are not rolled back. The VA allocation is freed (via `PreparedMapping` drop), but the page table pages are leaked in `page_table_allocs`. This is probably acceptable for now since partial failures are rare, but worth a TODO comment.

5. In `unmap_pages()`:
```rust
range._drop_guard.disarm(); // Unmap complete, Ok to drop MappedRange.
```
Accessing `_drop_guard` through the underscore-prefixed name works but is unusual. Consider naming it `drop_guard` without the underscore prefix.

---
Generated by Claude Code Patch Reviewer