Claude review: rust: drm: Add UnbindGuard for drm_dev_enter/exit critical sections

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the central safety-critical patch.

**UnbindGuard design**: The guard struct is clean:
```rust
pub struct UnbindGuard<'a, T: drm::Driver> {
    dev: &'a Device<T, Registered>,
    idx: i32,
}
```

The `Deref` implementation on `UnbindGuard` is the most safety-sensitive part:
```rust
unsafe { T::ParentDevice::from_device(self.dev.as_ref().as_bound()) }
```
This calls `as_bound()` on the parent `device::Device`, which presumably returns `&Device<Bound>`. The safety argument is that within the `drm_dev_enter/exit` critical section, the parent device must be bound because `Registration::drop` uses `drm_dev_unplug()` (which performs an SRCU barrier). This is correct: `drm_dev_unplug()` marks the device as unplugged and then calls `synchronize_srcu()`, so any existing `drm_dev_enter()` critical section will complete before unregistration proceeds.

**Concern**: The `as_bound()` method call assumes that `Device<Core>` or `Device<Normal>` can be safely cast to `Device<Bound>`. The safety here relies entirely on the SRCU critical section guarantee. The commit message documents this well, but I'd note that this depends on `Registration::drop` **always** using `drm_dev_unplug()` and never having an alternate code path that bypasses it (e.g., error cleanup paths). The code looks correct for this.

**Switch to drm_dev_unplug()**: The change in `Registration::drop`:
```rust
unsafe { bindings::drm_dev_unplug(self.0.as_raw()) };
```
This is essential and correct. Note that `drm_dev_unplug()` is a superset of `drm_dev_unregister()` — it calls `drm_dev_unregister()` internally after marking the device as unplugged. The switch is backward-compatible.

**Minor**: The typo fix from "the this" to "that this" in the existing SAFETY comment is a nice cleanup.

**`with_unbind_guard` convenience**: Simple and correct, no issues.

---
Generated by Claude Code Patch Reviewer