Add patina_nvme crate

[kat-perez]

Description

Adds a new patina_nvme crate that exposes thin wrappers over EFI_NVM_EXPRESS_PASS_THRU_PROTOCOL admin commands. Initial surface area is a single helper, lock_partition_write, which write-protects the NVMe boot partitions until the next power cycle via Set Features (FID 0x11, BPWPS).

This supersedes the placement explored in patina#1488, where the same helper lived inside patina_boot::partition. Reviewer feedback there (os-d, makubacki) made the case that patina_boot should not implement storage-protocol abstractions; this PR is the relocation.

The crate stays narrow on purpose:

• lib.rs — public lock_partition_write helper plus the unsafe inner Set Features dispatch.
• pass_thru.rs — minimal FFI bindings for EFI_NVM_EXPRESS_PASS_THRU_PROTOCOL (Protocol struct, command/completion shapes, opcode/FID/flag constants).

Like patina_boot from #9, patina_nvme pulls patina directly from the feature/patina-boot git branch until a patina release ships the required APIs (DevicePathBuf, etc.).

• Impacts functionality?
• Impacts security?
• Breaking change?
• Includes tests?
• Includes documentation?

How This Was Tested

cargo test --lib -p patina_nvme — all 6 unit tests pass:

test tests::test_lock_partition_write_locate_failure ... ok
test tests::test_lock_partition_write_handle_protocol_failure ... ok
test tests::test_lock_partition_write_set_features_payload ... ok
test tests::test_lock_partition_write_inner_issues_correct_set_features_command ... ok
test tests::test_lock_partition_write_inner_passthru_failure_propagates ... ok
test tests::test_lock_partition_write_inner_nonzero_completion_status_rejected ... ok

The unsafe FFI dispatch path is exercised via mock pass_thru function pointers that capture the constructed command and verify opcode/flags/CDW10/CDW11/queue type match the NVMe spec.

Integration Instructions

Consumers depend on patina_nvme = "0.1" from this repo. Until a patina release containing the new APIs is published, consumers needing to build against this crate will also need to redirect patina to the feature/patina-boot branch (matching the existing pattern in patina_boot/Cargo.toml).

Closes #61 (tracked on the SRE board) once patina#1488 is closed in favor of this PR.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 98.70130% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
patina_nvme/src/lib.rs	98.53%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!