Claude review: rust: drm: Add UnbindGuard for drm_dev_enter/exit critical sections

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the core safety patch. A few observations:

**Good**: The switch from `drm_dev_unregister()` to `drm_dev_unplug()` is essential and correctly placed. The C implementation of `drm_dev_unplug()` does:
```c
dev->unplugged = true;
synchronize_srcu(&drm_unplug_srcu);
drm_dev_unregister(dev);
```
So after `Registration::drop()` returns, all `drm_dev_enter()` critical sections that saw the device as plugged have completed.

**`UnbindGuard::deref()`** — the safety argument:
```rust
unsafe { T::ParentDevice::from_device(self.dev.as_ref().as_bound()) }
```
This calls `as_bound()` on the underlying `device::Device`. The safety comment says the parent is bound because we hold a `drm_dev_enter()` critical section. This is sound because `drm_dev_enter()` succeeding means `drm_dev_unplug()` hasn't completed `synchronize_srcu()` yet, which means the bus driver's `remove()` hasn't returned (since `drm_dev_unplug()` is called from `Registration::drop()`, which is called during unbind). So the device is indeed still bound.

**Minor**: The `as_bound()` call suggests there's an unsafe method on `Device` to assert the Bound context. The safety invariant here is well-argued but subtle — it would benefit from explicitly mentioning that `Registration::drop()` is the one calling `drm_dev_unplug()` so the temporal ordering is: `drm_dev_unplug()` → `synchronize_srcu()` → bus unbind completes. Currently the safety comment only says "the parent device is bound for the lifetime of this guard" without tracing why.

**`with_unbind_guard()`** is a nice convenience but note it doesn't give access to registration data — that comes later in patch 3. Fine for incremental development.

---
Generated by Claude Code Patch Reviewer