…ck refs

Fixes #11773.

The trimmable typemap generator emits, for each Java peer marshal method, a
UCO forwarder that calls the MCW-generated `n_*` callback via a cross-assembly
MemberRef. The MemberRef signature was built by `EncodeClrTypeForCallback`,
which encoded a JNI boolean (`Z`) parameter/return as `System.SByte`.

The real MCW `n_*` callbacks declare their JNI boolean as `System.Boolean`
(e.g. `AndroidX.Fragment.App.FragmentManager.IOnBackStackChangedListener.
n_OnBackStackChangeStarted_..._Z(IntPtr, IntPtr, IntPtr, bool)`). Because
`System.SByte != System.Boolean` in metadata, the emitted MemberRef could not
be bound to the real method, so ILC reported:

    ILC: Method '..._Proxy.n_OnBackStackChangeStarted_uco_*' will always throw
         because: Missing method 'Void ...n_OnBackStackChangeStarted_...(..., SByte)'

and replaced the forwarder body with a throw -- breaking every binding/AndroidX
interface listener callback that has a boolean parameter (and any boolean-
returning callback) under NativeAOT.

This was misdiagnosed as a trimming/preserve-edge problem. It is not: a rooted
cross-assembly call to a non-public static method -- including one declared on
an interface -- is preserved by ILC. The failure is purely a signature mismatch
in the generated MemberRef. Reproduced minimally by emitting an `sbyte` MemberRef
against a `bool` method and re-running ilc, which produces the exact
"will always throw / Missing method ... SByte" diagnostic from the issue;
switching the MemberRef to `bool` resolves and runs.

The fix encodes JNI boolean as `System.Boolean` for the callback MemberRef. The
UCO entry point keeps `byte` (blittable, unsigned) for the `[UnmanagedCallersOnly]`
ABI; only the managed `n_*` MemberRef changes. This matches the constructor path,
which already references managed boolean parameters as `System.Boolean`. Passing
the UCO `byte` argument to the `bool` parameter is valid IL (both are stack-int32;
JNI jboolean is always 0/1), mirroring the legacy LLVM-IR/marshal-methods path
which also targets the real `bool` `n_*` callbacks.

Four unit tests had codified the incorrect `sbyte` expectation; they are updated
to assert `System.Boolean` for the callback signature while keeping `System.Byte`
for the UCO ABI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…h capture

- Remove the banned null-forgiving `!` operator in the callback-signature
  emitter; narrow the captured type-name locals with `is not null` instead.
- Gate the base-hierarchy [Register] method/property n_* signature capture on
  HasAmbiguousCallbackType, matching AddMarshalMethod, so inherited non-
  boolean/char registrations don't pay for type resolution + method enumeration
  whose result is never used.

No behavior change; all 600 TrimmableTypeMap generator tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… unreadable

Fixes an XAGTT7009 build regression introduced by the metadata-driven callback
signature capture: real trimmable-typemap builds failed with e.g.

    error XAGTT7009: ... cannot emit the native callback reference
    'Org.XmlPull.V1.IXmlPullParserInvoker.n_IsEmptyElementTag' (JNI '()Z')
    because ... the real 'n_*' method's signature could not be resolved

Root cause (confirmed from the CI build.binlog): GenerateTrimmableTypeMap scans
the compile-time *reference* assemblies (Microsoft.Android.Ref/.../Mono.Android.dll
was the only Mono.Android in the log; no runtime/impl assembly is fed). Reference
assemblies strip the `private static n_*` methods, so the capture added in this PR
returns null for every framework boolean/char callback, and the previous hard
`throw` then failed the build. The original code never read the n_* method — it
emitted the MemberRef by name from the connector metadata (present in the ref
assembly's [Register] attributes) — so this was a self-inflicted regression.

Fix: instead of throwing when the n_* signature can't be read, fall back to the
blittable encoding (JNI boolean -> sbyte, char -> ushort). This is correct, not a
blind guess: an unreadable n_* means a reference assembly, i.e. a framework binding
(Mono.Android/Java.Interop), which is always produced by the current post-#1296
generator and therefore uses sbyte/ushort — matching the runtime n_* (verified:
runtime Mono.Android n_IsEmptyElementTag is int8/sbyte). NuGet binding
implementation assemblies (e.g. AndroidX) still ship the real n_* in lib/, so their
signature is captured exactly, preserving the pre-#1296 `bool` fix for #11773.

- EncodeClrTypeForCallback: boolean -> sbyte, char -> ushort (blittable fallback),
  used only when no captured signature is available.
- Emitter: use captured signature when present, else the blittable fallback; the
  hard throw and its helper are removed.
- Tests: replace the throws-when-unresolved test with one asserting the sbyte
  fallback; update the fallback encoding theory (boolean->0x04, char->0x07).
  Verified locally that a concrete peer scanned from the ref Mono.Android now
  generates n_IsEmptyElementTag as System.SByte without throwing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>