Claude review: gpu: nova-core: add INTR_CTRL interrupt controller API

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the core of the series and is well-designed.

**Type-state design:** The `Idle → Unarmed → Pending` state machine for `Top` is excellent:
```rust
impl Top<Idle> { fn unarm(self, bar) -> Top<Unarmed> }
impl Top<Unarmed> { fn read_pending(self, bar) -> Top<Pending> }
impl Top<Pending> { fn rearm(self, bar) }
```
This makes it impossible to rearm without first reading pending state, catching a real hardware programming mistake at compile time.

**Issue:** The `Subtree::iter_leaves` method:
```rust
fn iter_leaves<'a>(self, ctrl: &'a IntrCtrl,) -> impl Iterator<Item = Leaf<Idle>> + 'a {
    (0..2usize).filter_map(move |offset| {
        let idx = self.index * 2 + offset;
        LeafIndex::try_new(idx).map(|idx| ctrl.leaf(idx))
    })
}
```
`self.index` comes from iterating `0..32` in `iter_subtrees()`. For pre-Hopper, `subtree_mask` is `0x0f`, so indices 0-3 are possible, giving leaf indices 0-7 (all within bounds for `LeafIndex = Bounded<usize, 4>` which allows 0-15). For Hopper, indices 0-7 map to leaves 0-15. This is correct.

However, the `iter_subtrees` method iterates `0..32`:
```rust
pub(super) fn iter_subtrees(&self) -> impl Iterator<Item = Subtree> + '_ {
    (0..32usize)
        .filter(move |&bit| self.state.mask & (1u32 << bit) != 0)
        .map(|index| Subtree { index })
}
```
If a hardware bug or corruption set bit 8+ in TOP on a pre-Hopper chip, this would produce subtree indices ≥8, leaf indices ≥16, and `LeafIndex::try_new()` would return `None`, silently dropping those leaves. This is safe but could silently miss bogus interrupt state. Arguably that's the right behavior since those bits are undefined on pre-Hopper.

**Minor:** `#[expect(dead_code)]` on the `irq` module in `nova_core.rs` is pragmatic - the module is added here but only consumed later in patch 6. Patch 6 then changes this to `#[cfg_attr(not(CONFIG_NOVA_CORE_IRQ_SELFTEST), expect(dead_code))]`, which means without the selftest config, the entire `irq` module (including `alloc_vector`) is dead code. This is fine for now since the module will gain users in future patches, but it's unusual to land code that's entirely dead in the default configuration.

---
Generated by Claude Code Patch Reviewer