Claude review: gpu: nova-core: use HRT lifetime for Bar

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the most interesting patch from a safety perspective. `NovaCore` becomes `NovaCore<'bound>` holding the bar directly, and `Gpu` borrows it:

```rust
pub(crate) struct NovaCore<'bound> {
    pub(crate) gpu: Gpu<'bound>,
    bar: pci::Bar<'bound, BAR0_SIZE>,
    _reg: Devres<auxiliary::Registration<ForLt!(())>>,
}
```

The self-referential initialization:
```rust
Ok(try_pin_init!(NovaCore {
    bar: pdev.iomap_region_sized::<BAR0_SIZE>(0, c"nova-core/bar0")?,
    // SAFETY: `bar` is initialized before this expression is evaluated
    // (`try_pin_init!()` initializes fields in declaration order), lives at a
    // pinned stable address, and is dropped after `gpu` (struct field drop order).
    gpu <- Gpu::new(pdev, unsafe { &*core::ptr::from_ref(bar) }),
    ...
}))
```

**This is the most concerning code in the series.** The `unsafe { &*core::ptr::from_ref(bar) }` creates a reference to `bar` from within the same `try_pin_init!` block. The safety argument relies on:
1. `try_pin_init!` initializing fields in declaration order (so `bar` is valid)
2. The struct being pinned (so `bar` won't move)
3. Struct field drop order (declaration order: `gpu` drops before `bar`)

Point 3 is critical -- if `gpu` somehow outlived `bar`, the `&'bound Bar0` reference inside `Gpu` would dangle. Rust guarantees struct fields drop in declaration order, and `gpu` is declared before `bar`, so `gpu` drops first. This is correct.

However, the `core::ptr::from_ref(bar)` trick essentially bypasses the borrow checker for self-referential init. The TODO comment acknowledges this should use proper pin-init self-referential support once available. The approach is reasonable as a temporary measure but should be tracked.

---
Generated by Claude Code Patch Reviewer