Claude review: gpu: nova-core: gsp: add mutex locking to Cmdq

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the main event. Key design decisions:

1. **All mutable state moved to `CmdqInner`** wrapped in `Mutex<CmdqInner>`:
```rust
pub(crate) struct Cmdq {
+    #[pin]
+    inner: Mutex<CmdqInner>,
}
```

2. **`Cmdq` methods now take `&self`** instead of `&mut self`, enabling shared access from multiple threads.

3. **The mutex is held across send+receive in `send_command`**:
```rust
+        let mut inner = self.inner.lock();
+        inner.send_command(bar, command)?;
+        loop {
+            match inner.receive_msg::<M::Reply>(Self::RECEIVE_TIMEOUT) {
```

This is correct for ensuring reply ordering -- no other command can slip in between send and receive.

4. **`dma_handle()` now acquires the mutex**:
```rust
+    pub(crate) fn dma_handle(&self) -> DmaAddress {
+        self.inner.lock().gsp_mem.0.dma_handle()
+    }
```

This is called during init from `MessageQueueInitArguments::new()`. Since `dma_handle()` returns an immutable property (the DMA address doesn't change after allocation), acquiring the mutex here is unnecessary overhead but harmless. If this becomes a hot path in the future, it could be worth storing the DMA handle separately outside the mutex, but for now this is fine.

5. **`boot()` signature change** drops `mut` from `Pin<&mut Self>`:
```rust
-        mut self: Pin<&mut Self>,
+        self: Pin<&mut Self>,
```

This is correct since `cmdq` methods no longer need `&mut self`.

6. **Potential concern -- holding mutex during `receive_msg` timeout**: The `receive_msg` call inside `send_command` can block for up to `RECEIVE_TIMEOUT` (5 seconds) while holding the mutex lock. During this time, no other thread can send commands or receive messages. The cover letter acknowledges this: "For now this should be ok, and we expect GSP to be fast anyway." This is acceptable for the current use case but worth noting for future scaling.

7. **The `receive_msg` public wrapper also acquires the lock**:
```rust
+    pub(crate) fn receive_msg<M: MessageFromGsp>(&self, timeout: Delta) -> Result<M>
+    ...
+        self.inner.lock().receive_msg(timeout)
```

This is used by `wait_gsp_init_done` and `GspSequencer::run`, which call `receive_msg` in loops. Each iteration will acquire and release the lock, which is fine -- it allows other threads to interleave between iterations.

The `ALLOCATE_TIMEOUT` constant correctly moved from `Cmdq` to `CmdqInner` since it's only used by `CmdqInner::send_single_command`.

The `dev_dbg!`/`dev_err!` changes from `self.dev` to `&self.dev` are because `dev` is now `ARef<device::Device>` inside `CmdqInner` and the macro needs a reference.

No blocking issues. The series is clean and well-decomposed.

---
Generated by Claude Code Patch Reviewer