Document Metal buffer view ownership

src/engine/metal/gpu.rs

@@ -846,6 +846,10 @@ impl Buffer {
     }
 
     pub(super) fn view(&self, offset: u64, bytes: u64) -> Result<Self, String> {
+        // SAFETY: native/metal/ds4_metal.m:7916-7940 bounds-checks the view,
+        // ARC-retains base_obj.buffer at :7926, and marks the view non-owning at
+        // :7929, so it may outlive and be freed independently of this wrapper.
+        // Recheck those guarantees whenever the vendored Metal file is re-synced.
         NonNull::new(unsafe { ds4_gpu_tensor_view(self.raw(), offset, bytes) })
             .map(Self)
             .ok_or_else(|| "Metal could not create a tensor view".to_owned())