Claude review: drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This is the core abstraction patch. `struct v3d_submit` groups `v3d_dev`, `file_priv`, `drm_exec`, and a fixed-size jobs array.

**Concern: Missing bounds check in v3d_submit_add_job()**

`v3d_submit_add_job()` does:
```c
submit->jobs[submit->job_count++] = job;
```
without checking `submit->job_count < V3D_MAX_JOBS_PER_SUBMISSION`. All current callers respect the limit (CL submits at most 3, CSD 2, TFU 1, CPU indirect CSD 3), but a missing bounds check on a stack-allocated fixed-size array is a latent buffer overflow waiting for someone to add a fourth job. I'd recommend adding:

```c
if (submit->job_count >= V3D_MAX_JOBS_PER_SUBMISSION)
    return -EINVAL;
```

**CSD ioctl manually adds jobs to the array**: In the CSD ioctl, after calling the old `v3d_setup_csd_jobs_and_bos()`:
```c
submit.jobs[submit.job_count++] = &job->base;
submit.jobs[submit.job_count++] = clean_job;
```
These jobs were created by the old `v3d_job_init()` path, not by `v3d_submit_add_job()`. This is a transitional state that gets cleaned up in patch 10 — acceptable for bisectability.

---
Generated by Claude Code Patch Reviewer