Decouple the I3C ISR from thread-owned state

The ISR no longer fabricates a &mut over any thread-owned object. The
per-bus registry now parks an IsrCtx (an ISR-side register handle plus
the role flag) instead of a raw context pointer, and the service routine
works exclusively through &self register methods, per-bus ISR_EVENTS
atomics, and the global IBI rings. Master transfer completion follows
the SMC flag-and-defer model: the ISR masks the completion sources and
latches the status; the polling thread drains the response queue into
its own transfer and re-enables the sources. Target-mode completions
and the master-assigned dynamic address move into the per-bus event
block; ISR-side halt/resume recovery (which needs the wait policy) is
deferred to the thread as a fault flag.

This dissolves the machinery the old design needed: the curr_xfer
AtomicPtr handoff and its unsafe reconstruction, I3cXfer's completion
flag, and the pinned 'static I3cCore (with its singleton! storage and
Pin plumbing) are all gone. The controller is a plain owned value with
zero unsafe; in-flight transfer overlap is structurally impossible
because the transfer never leaves the thread.

The controller borrows its I3cConfig (&'c mut) rather than owning it:
the config embeds ~0.5 KiB of device tables, and the typestate
transition moves the controller by value, so owning the config would
transiently stack multiple copies and overflow the 2 KiB kernel
bootstrap stack (observed as a silent hang during bring-up on the EVB).
Borrowing keeps exactly one config alive in the caller's frame, the
same footprint as the validated pre-rework layout, and matches the I2C
driver's caller-owned-resource convention.

Behavioral deltas from the reference ISR, all thread-visible only:
SIR address validation moves from the ISR to the consumer (which
already validates), and target error recovery runs at the next
operation instead of inside the interrupt.

Verified on a two-board AST1060 setup: the dual-device IBI exchange
test passes 10/10 exchanges.