rustdv-gpi

Safe wrapper over the simulator programming interface (design-doc §3.3). Invariants upheld here so everything above is safe Rust:

1. Handles are opaque and non-null; fallible acquisition is Result.
2. Object-handle lifetime = simulation lifetime (freely Copyable IDs). Callback registrations are modeled by RAII ([CallbackHandle]): dropping a live handle removes it, and fired one-shots remove themselves from inside the trampoline while both supported simulators still accept the registration handle.
3. Strings are copied at the boundary, every call.
4. No unwinding across FFI: every trampoline wraps the closure in catch_unwind; panics are routed to the panic sink.
5. Callback user-data ownership: an Rc whose C-side reference is reclaimed exactly once (on fire for one-shots, on removal otherwise).

Thread affinity (§3.4): all types here hold raw pointers and are therefore !Send/!Sync — the compiler rejects moving them off the simulator thread.