Claude review: gpu: nova-core: send UNLOADING_GUEST_DRIVER GSP command upon unloading

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This patch makes `Gpu` implement `PinnedDrop` to send the `UNLOADING_GUEST_DRIVER` RPC to the GSP when the driver unbinds.

**Observations:**

1. The `Gpu` struct gains a `device` field to retain the device reference for the drop path:
```rust
#[pin_data(PinnedDrop)]
pub(crate) struct Gpu<'gpu> {
    device: &'gpu device::Device<device::Bound>,
    ...
```
This is necessary since `PinnedDrop::drop` doesn't receive the device as a parameter. Note the upstream base already has `bar: &'gpu Bar0` so this is consistent with the existing pattern.

2. The `PinnedDrop` implementation:
```rust
fn drop(self: Pin<&mut Self>) {
    let this = self.project();
    let device = *this.device;
    let bar = *this.bar;

    let _ = this
        .gsp
        .as_ref()
        .get_ref()
        .unload(device, bar, &*this.gsp_falcon)
        .inspect_err(|e| dev_err!(device, "failed to unload GSP: {:?}\n", e));
}
```
The `let _ =` properly discards the error after logging it — correct for a drop path where there's nothing more to do. The `.as_ref().get_ref()` chain on the pin projection is the standard way to get `&Gsp` from a pinned field.

3. The `shutdown_gsp` method correctly polls mailbox0 for the `LIBOS_INTERRUPT_PROCESSOR_SUSPENDED` bit:
```rust
const LIBOS_INTERRUPT_PROCESSOR_SUSPENDED: u32 = bits::bit_u32(31);
read_poll_timeout(
    || Ok(gsp_falcon.read_mailbox0(bar)),
    |&mb0| mb0 & LIBOS_INTERRUPT_PROCESSOR_SUSPENDED != 0,
    Delta::from_millis(10),
    Delta::from_secs(5),
)
```
5-second timeout with 10ms polling interval is reasonable for firmware shutdown.

4. The `PowerStateLevel` enum uses `#[expect(unused)]` which correctly anticipates that `Level3` and `Level7` are not used yet but will be needed for suspend/hibernate support. Only `Level0` (full unload) is used currently.

5. The `UnloadingGuestDriver` command implementation follows the existing pattern for `SetRegistry` and `SetGuestSystemInfo` commands — consistent and correct.

6. The `SAFETY` comments on `AsBytes` and `FromBytes` impls for `UnloadingGuestDriver` look correct — the struct is `#[repr(transparent)]` wrapping a C struct with explicit padding (`__bindgen_padding_0: [u8; 2usize]`), so no uninitialized padding.

7. `is_power_transition` method:
```rust
pub(crate) fn is_power_transition(self) -> bool {
    self != PowerStateLevel::Level0
}
```
This is clean and semantically clear.

**No issues.** Well-implemented.

---

---
Generated by Claude Code Patch Reviewer