Isolate managed emitted-shape reflection for Native AOT

[nickna]

Summary

• add a closed reflection boundary for known compiler-emitted managed shapes
• reject those hybrid bridges under Native AOT before reflection
• route $Object, $TSFunction/$BoundTSFunction, $WritableStream, and $MessagePort through the boundary
• keep arbitrary CLR Fields/Invoke/SetProperty fallbacks visible for the separate native interop policy
• replace Proxy's private $TSFunction._method inspection with the public callable dispatcher contract
• lower the analyzer baseline from 151 to 139 warnings

Verification

• scripts/aot-analyzer-report.ps1 -SkipBuild -EnforceBaseline
• focused worker/streams/VM/dispatcher tests: 329 passed
• focused Proxy/async-hooks/crypto/dispatcher tests: 178 passed
• win-arm64 Native AOT publish and interpreter smoke: passed
• native image: 93,500,416 bytes (+37,888 / 0.041% from the prior checkpoint; still -949,760 / 1.01% from the original baseline)

The full test suite was also attempted. This Windows host's HttpListener returned The handle is invalid, causing unrelated HTTP/fetch failures and the run to time out. The affected focused suites above are green.