Claude review: accel/neutron: Add job submission IOCTL

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**`job->type` is never set (latent bug):**

In `neutron_ioctl_submit_job`:

```c
switch (args->type) {
case DRM_NEUTRON_JOB_INFERENCE:
    memcpy(&job->inference, &args->inference,
           sizeof(args->inference));
    break;
default:
    ...
}
```

The switch validates and copies the inference data, but `job->type` is never assigned from `args->type`. Later, `neutron_hw_submit` switches on `job->type`:

```c
switch (job->type) {
case DRM_NEUTRON_JOB_INFERENCE:
    ...
default:
    dev_WARN(ndev->dev, "Unknown job type: %d\n", job->type);
```

This only works by accident because `DRM_NEUTRON_JOB_INFERENCE = 0` and `kzalloc` zeroes the struct. If more job types are added or the enum value changes, this will break. Add `job->type = args->type;` after the switch.

**UAPI: `DRM_IOCTL_NEUTRON_SUBMIT_JOB` should be `DRM_IOW`, not `DRM_IOWR`:**

Same issue as SYNC_BO -- the ioctl doesn't write anything back.

**UAPI: `pad` fields in `drm_neutron_inference_job` not validated:**

```c
struct drm_neutron_inference_job {
    __u32 tensor_offset;
    __u32 microcode_offset;
    __u32 tensor_count;
    __u32 pad[5];
};
```

The `pad[5]` array is documented as MBZ but not validated to be zero. For future extensibility, all MBZ pad fields in UAPI structs should be checked. The top-level `args->pad` is checked, but `args->inference.pad` is not.

**`neutron_job_done_handler` returns void but calls `return neutron_job_err_handler(ndev)`:**

```c
if (state.status != NEUTRON_FW_STATUS_DONE) {
    ...
    return neutron_job_err_handler(ndev);
}
```

`neutron_job_err_handler` returns void, so this works but `return;` followed by `neutron_job_err_handler(ndev);` on a separate line would be more conventional.

**`neutron_timedout_job` does force suspend/resume with active scheduler:**

```c
drm_sched_stop(&ndev->sched, sched_job);
scoped_guard(mutex, &ndev->job_lock)
    ndev->active_job = NULL;
pm_runtime_force_suspend(ndev->dev);
pm_runtime_force_resume(ndev->dev);
drm_sched_start(&ndev->sched, 0);
```

The `pm_runtime_force_suspend` will call `neutron_runtime_suspend` which calls `neutron_shutdown`. After patch 8, `neutron_shutdown` calls `neutron_read_log` which reads device memory. But the device was already in a faulted state -- this should be safe since the device memory is still mapped. OK.

---
Generated by Claude Code Patch Reviewer