Claude review: rust: page: convert to `Ownable`

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This converts `Page` from having its own `Drop` impl to implementing `Ownable`, and changes the internal representation from `NonNull<bindings::page>` to `Opaque<bindings::page>` with `#[repr(transparent)]`.

> +#[repr(transparent)]
> pub struct Page {
> -    page: NonNull<bindings::page>,
> +    page: Opaque<bindings::page>,
> }

This is a significant representation change. `Page` is no longer pointer-sized; it's now the size of a `struct page`. All ownership goes through `Owned<Page>` (which is pointer-sized). The transparent repr is needed for the pointer casts between `Page` and `bindings::page` to be valid.

> -pub struct BorrowedPage<'a>(ManuallyDrop<Page>, PhantomData<&'a Page>);
> +pub struct BorrowedPage<'a>(ManuallyDrop<Owned<Page>>, PhantomData<&'a Owned<Page>>);

The `ManuallyDrop<Owned<Page>>` prevents the `Owned::drop` from freeing the page when `BorrowedPage` goes out of scope. This preserves the existing borrow semantics.

> +    pub fn alloc_page(flags: Flags) -> Result<Owned<Self>, AllocError> {
> ...
> +        Ok(unsafe { Owned::from_raw(page.cast()) })

The `page.cast()` converts `NonNull<bindings::page>` to `NonNull<Page>`. Since `Page` is `#[repr(transparent)]` over `Opaque<bindings::page>`, the cast is layout-compatible.

> +unsafe impl Ownable for Page {
> +    unsafe fn release(this: NonNull<Self>) {
> +        unsafe { bindings::__free_pages(this.cast().as_ptr(), 0) };

`this.cast()` goes from `NonNull<Page>` to `NonNull<bindings::page>` (inferred from `__free_pages` signature). Valid due to transparent layout.

No bugs found in this patch.

---
Generated by Claude Code Patch Reviewer