Harden the Native AOT release path from the #1324 review

[nickna]

Summary

An architectural review of the #1324 epic (before the first tagged release) confirmed the design is sound but found a handful of concrete defects and unenforced guarantees. This PR fixes all of them.

Release blockers

• Compile errors print to stderr. The generic compile-error branch in Program.cs and the explicit-bundler failure branch wrote to stdout. The tag-time macOS native smoke greps stderr for PE-Packer's Mach-O refusal (cannot target), so the first osx-* release job would have failed on a stream mismatch. One test asserted the old stdout behavior and was updated to the new contract.
• publish.yml now validates before it publishes. Previously the publish job pushed NuGet and created the GitHub Release first, and the artifact matrices merely uploaded afterwards — a failing RID left a silently missing asset behind an already-public package. New shape: build (pack + test) → binaries + native-binaries (all twelve artifact smokes) → tag-only release job that pushes NuGet and attaches every archive. Also:
  • workflow_dispatch runs the full matrix as a no-publish dry run (0.0.0-dryrun.N versions) — run it once before the first real tag to validate the windows-11-vs2026-arm / macos-15-intel runner labels.
  • win-arm64/linux-arm64 managed artifacts now build and smoke on real arm runners instead of shipping never-executed cross-publishes.
  • Native release smokes gain the five Managed-SKU-only refusal assertions (fork, -r, .NET interop, --gen-decl, --verify), features.ts, the per-RID publish-warning ratchet, and CRLF normalization so grep -qx works on Windows RIDs.

Native-SKU behavior fixes

• ManagedStructuralClrReflection probes return null under Native AOT instead of throwing. Every call site (Proxy traps, FromAnyObject, vm context, KeyObject export…) is a structural probe with its own guest-level fall-through error, and the open CLR universe is empty by construction in a native process (arbitrary CLR objects can only enter via the .NET interop boundary, which rejects native first). A plain-TypeScript program running natively now gets its ordinary "…is not a function" error, never a reflection PlatformNotSupportedException. Methods renamed TryGet* to make the probe semantics explicit.
• ManagedEmittedShapeReflection.IsShape answers false for every shape under native, so RuntimeCallableDispatcher.IsCallable/Invoke can no longer disagree (predicate said yes, action threw). RequireManagedShape checks native before shape so unguarded callers get the clear named diagnostic.
• Native-SKU extraction failure of the embedded managed runtime is now fatal instead of warning-and-continue — it is the only soft-dependency mechanism the native SKU has, and it was the one native limitation that didn't fail fast.

Guardrails

• Mandatory AOT flags own their home in SharpTS.csproj behind PublishAot=true (TrimMode=partial, IlcTrimMetadata=false, IlcGenerateCompleteTypeMetadata=true, StackTraceSupport=true); ci.yml/publish.yml no longer duplicate them, and a local dotnet publish -p:PublishAot=true matches CI instead of producing a broken binary.
• Payload validation: a Native AOT publish without SharpTSManagedRuntimePayloadPath is a build error (opt-out: SharpTSAllowMissingManagedRuntimePayload=true for probe builds), and the payload's PE Machine word must be AnyCPU/I386 — the arch-stamped-payload failure mode was previously reproduced in the wild ("SharpTS runtime not present" under a different arch's dotnet).
• features.ts now forces the TypeBuilderInstantiation fallback (Promise<Counter> + typed Counter[] close runtime open generics over TypeBuilder args). Previously only the async builder's MethodBuilderInstantiation fallback executed in CI, despite comments claiming both. Both gates assert the new 2 2 33 7 11 output.
• Architecture tests (SharpTS.Tests/Architecture/) pin the seam routing: raw MakeGenericType/MakeGenericMethod outside EmitGenerics/TypeProvider/ManagedDotNetInterop, or any resurrected CustomAttributeBuilder use, fail the suite — a copy-pasted suppression can no longer satisfy the analyzer ratchet while breaking the native compiler.
• CustomAttributeEncoder gets byte-exact §II.23.3 blob tests plus a persisted-assembly round trip; null Type args now encode as the 0xFF null SerString and null value-type args throw a named error instead of NRE. EmbeddedManagedRuntime's atomic-write discipline (temp + rename, overwrite, cleanup, locked destination) is unit-tested via a stream overload split from the resource lookup.
• Ratchet scripts print their per-record diff before failing (Write-Error under ErrorActionPreference=Stop terminated before the detail printed) and fail on a zero-line parse when the baseline expects warnings — closing the silent-green vector from localized runner output or diagnostic-format drift.
• test-examples.ps1 -MinimumExecuted fails the corpus gate if executed (non-skipped) cases drop below a floor (CI: 50 ≈ losing a whole path), so a refactor that mass-skips can't go green.
• Docs: TypeProvider is documented as the fifth, deliberately unguarded seam with its invariant stated; stale NodeRegistry references in CONTRIBUTING.md and docs/plans/native-aot.md rewritten to describe the shipped catalog + dispatch-switch design; native-aot.md updated for the flag ownership, gated release flow, and probe semantics.

Known follow-up (not in this PR)

The extraction/co-location path ships only SharpTS.dll, no dependency closure — eval/vm code reaching zlib needs ZstdSharp.dll, which the test harness copies explicitly but production does not. Which dependencies the soft-dep contract promises is a design decision; deliberately left for its own issue.

Test plan

• Full suite: 16,283/16,283 pass (Category!=LiveNetwork&LoadSensitive)
• scripts/aot-analyzer-report.ps1 -EnforceBaseline — inventory still exactly zero
• features.ts interpreted + compiled under JIT both print 2 2 33 7 11
• csproj gates exercised locally: AnyCPU payload accepted; arch-stamped payload rejected (caught the arm64 apphost at 0xAA64); PublishAot=true without payload rejected with guidance
• Ratchet scripts exercised against synthetic logs: diff detail prints, empty parse fails
• Both workflow files YAML-validated
• After merge: trigger the publish.yml workflow_dispatch dry run to validate the six native runner labels before the first tag

Part of #1324.