Claude review: rust/drm: Introduce DeviceContext

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the core of the series and is well-designed. The typestate pattern with `Uninit` / `Registered` is clean.

**Soundness of `assume_ctx` transmute:**
```rust
pub(crate) unsafe fn assume_ctx<NewCtx: DeviceContext>(&self) -> &Device<T, NewCtx> {
    // SAFETY: The data layout is identical via our type invariants.
    unsafe { mem::transmute(self) }
}
```
The invariant "The data layout of `Self` remains the same across all implementations of `C`" is stated but relies on the fact that `PhantomData<C>` is ZST and `C` itself is ZST. This is correct for `Registered` and `Uninit` (both are unit structs), but the invariant could be made stronger by adding a compile-time assertion (e.g., `const_assert!(size_of::<Device<T, Uninit>>() == size_of::<Device<T, Registered>>())`). This would protect against future `DeviceContext` implementations that might not be ZST.

**`Registration::new` uses `mem::forget` + `ARef::from_raw`:**
```rust
let new = NonNull::from(unsafe { drm.assume_ctx() });
mem::forget(drm);
let new = unsafe { ARef::from_raw(new) };
```
This is correct but subtle. The `assume_ctx` returns a `&Device<T, Registered>` from which a `NonNull` is derived. Then the `UnregisteredDevice` is forgotten (preventing its `Drop` from running, which would `dec_ref` the inner `ARef`). Finally a new `ARef` is created from the pointer. This correctly transfers ownership of the reference count. The approach is sound but would benefit from a brief inline comment explaining the reference count transfer.

**`new_foreign_owned` lifetime concern:**
```rust
pub fn new_foreign_owned<'a>(
    drm: drm::UnregisteredDevice<T>,
    dev: &'a device::Device<device::Bound>,
    flags: usize,
) -> Result<&'a drm::Device<T>>
```
The returned `&'a drm::Device<T>` is tied to the lifetime of `dev`. The safety comment says:
```rust
// SAFETY: Since `reg` was passed to devres::register(), the device now owns the lifetime
// of the DRM registration - ensuring that this references lives for at least as long as 'a.
```
This relies on `devres::register()` ensuring the `Registration` lives at least as long as the `device::Device<device::Bound>`. This is correct by the devres contract — the registered resource is released when the device is unbound, which is when the `&'a` reference expires. However, there's a subtle point: if `devres::register` fails, the `Registration` would be dropped, calling `drm_dev_unregister`. The `?` on that call handles the error path correctly.

**Minor nit:** The doc comment has `s/DeviceContext/DeviceContext/` in the V2 changelog which is a no-op rename.

---
Generated by Claude Code Patch Reviewer