[native] Replace std::mutex with pthread_mutex_t in the CoreCLR host - #12541

#12545)

Part of #12533. Builds on the mutex changes from #12541, which is now merged into `main`.

## Why

The CoreCLR host's timing support still reached into `libc++` for memory management:

- `Timing::sequence_pool` was a `std::vector<managed_timing_sequence>`. It returned pointers to managed code as `IntPtr`; growing the vector could move its elements and invalidate every outstanding pointer.
- `Host::_timing` held the single process-lifetime `Timing` instance in a `std::shared_ptr`, despite there being no shared ownership or dynamic lifetime.
- `FastTiming` still used `new`/`delete`, `std::stack`, `std::string`, `std::function`, and `std::chrono` in paths that do not need those abstractions.

## Final implementation

### Stable managed timing sequences

`Timing` allocates sequences in linked chunks of 16. Chunks never move or free, so every address handed to managed code remains valid for the process lifetime. Entries are recycled through `in_use`; a double release remains a harmless redundant store rather than corrupting a free list. Allocation failure aborts consistently with other required runtime allocations.

With the vector gone, `Timing` contains only constant-initialized state. CoreCLR stores it directly as a `static inline` process-lifetime instance, and callers use `FastTiming::enabled()` rather than a nullable ownership pointer.

### Allocation-free open-event stack

`FastTiming` event records already live at stable addresses in process-lifetime chunks. Each `TimingEvent` now carries a `previous_open_event` link, and the per-thread stack is a single `thread_local TimingEvent*`. Starting and ending an event performs no allocation, requires no lock, and needs no TLS destructor or `__cxa_thread_atexit` registration. An unbalanced sequence cannot leak a separately allocated stack node.

Event chunks use `calloc`/`free`, preserving stable references while avoiding `operator new`/`operator delete`.

### Plain timing strings and file names

`TimingEvent::more_info` is a NUL-terminated `char*` built with one `malloc` and direct copies. Because timing is diagnostic, allocation failure drops only that event's optional detail.

Timing output file names use a 128-byte inline buffer for normal values and `malloc`-owned storage for longer bundled `debug.mono.timing` / `debug.dotnet.timing` values, which are not constrained by Android's system-property limit. If that fallback allocation fails, timing warns and writes to the default `timing.txt` instead of aborting the application. The inline buffer, null heap pointer, and configured flag remain constant-initialized.

### Removing unnecessary type erasure and `chrono`

- `FastTiming::dump` uses a plain line-writer function pointer plus a typed `FILE*` context instead of `std::function`.
- `AssemblyStore::configure_from_payload` accepts its diagnostic `const char*` directly instead of wrapping a lambda and allocating a temporary `std::string`.
- Timestamps are plain `uint64_t` nanosecond counts from `clock_gettime(CLOCK_MONOTONIC)`. A shared `time_interval` reproduces the former `duration_cast` output exactly, including total milliseconds and nanoseconds within the final millisecond.

MonoVM shares `Timing` and receives the allocator changes; `monodroid-glue.cc` also formats the new plain-nanosecond interval.

## Results

| | libc++ refs | `__cxa_guard_*` |
|---|---:|---:|
| #12541 baseline | 47 | 10 |
| this PR | **38** | **8** |

The removed references include the `std::shared_ptr` control-block family, one `operator new`, one `__libcpp_verbose_abort`, and one pair of `__cxa_guard_acquire` / `__cxa_guard_release`. The `__cxa_thread_atexit` category is eliminated from the timing path. NativeAOT remains at 0.

The simple ARM64 CoreCLR APK decreases by 24 KiB (0.36%); `libmonodroid.so` itself decreases by 27,144 bytes (5.05%). The four affected APK-size references are updated from CI output.

## Coverage

- The timing duration contract is pinned at compile time: `1,500,000,123 ns` remains `1:1500::123`.
- The device integration test grows the concurrent event store beyond one chunk and dumps it.
- The same test covers both the short Android system-property filename path and a 144-byte bundled-property filename that requires heap fallback.
- CoreCLR, MonoVM, and NativeAOT build paths are covered by the full CI matrix.

…12571)

Part of #12533: remove the remaining allocating C++ library types from the CoreCLR assembly store and its decompressed-assembly cache.

<!-- stack-prerequisites -->
All prerequisites (#12541, #12545, #12551, #12552, #12560, #12568, and #12570) have merged. This branch was rebuilt on `main` at `4b0cc8efa9`. The runtime changes are confined to `src/native/clr/host/assembly-store.cc`, with cache regression coverage and APK size baseline updates alongside them. The already-merged startup, timing, DSO-loader, and other prerequisite changes are no longer included in this PR's diff. Upstream's pthread-backed `lock_guard` is preserved.
<!-- /stack-prerequisites -->

### Changes

- Replace `std::deque<WriteRequest>` with an intrusive FIFO linked through `WriteRequest::next`.
- Replace the queued request's `std::unique_ptr<uint8_t[]>` with an explicit `uint8_t *payload`. Allocate the request and payload separately with two `malloc` calls and release both with two `free` calls on every completed or discarded write. If payload allocation fails, release the request and skip the write. No trailing-storage pointer arithmetic or explicit over-alignment is needed.
- Replace the cache directory and per-request `std::string` paths with a process-lifetime directory string and checked `snprintf` formatting. Requests store the descriptor index instead of a path; the writer reconstructs the destination from the immutable cache directory. Replace temporary-file name construction and matching with `snprintf` and `strstr`.
- Use a scoped `CachePath` buffer for directory creation, reads, writes, and stale-file cleanup. Short paths remain on the stack; longer paths retry in an exactly sized `malloc` allocation that is freed on every exit. Formatting and allocation failures are logged and remain non-fatal for the optional cache, unlike the abort-on-failure `Util::format_with_retry` helper.
- Allocate the decompression tracking array and assembly-name table with `calloc`, replacing their `unique_ptr`/`new[]` allocations.
- Extend the existing device cache regression test with a Java Application that supplies a code-cache directory longer than 1 KB. Cover persistence, mapping, corruption recovery, and stale temporary-file cleanup for both ordinary and long paths.

The asynchronous writer, queue byte limit, cache footer validation, and scope-based pthread locking are retained. `Util::LocalPathBufferSize` is the stack fast-path size, not a hard path limit; truncated paths are never used for I/O. The change does not alter linker flags or other runtime hosts.

### Original measurements

These results were recorded on the original pre-rebuild branch, **not on the current revision**:

| Release, arm64 | Before | After |
|---|---:|---:|
| Undefined libc++ references in `assembly-store.cc.o` | 12 | 0 |
| Undefined libc++ references across the CoreCLR host | 12 | 0 |
| `libnet-android.release.so` size | 520,112 bytes | 203,776 bytes |

Reaching zero references allowed the linker to stop pulling members from `libc++_static.a`. Relinking without libc++ also succeeded on that original branch; dropping the linker flag remains a follow-up.

### Current validation status

The malloc fallback passed sanitizer-backed host cases covering stack/heap boundaries, nested lifetimes, allocation failure, and formatting/retry failures. The cache namespace extracted unchanged from the current source, using the real CRC32 and mutex helpers with runtime configuration/property stubs, compiled with the Android NDK for arm64, arm32, and x86_64. A standalone arm64 emulator harness passed cache initialization, asynchronous persistence, mmap reads, corruption recovery, and stale-file cleanup with both short and greater-than-1-KB paths. The generated Java regression-test application also compiled against the Android API. `git diff --check` passes.

A local `dotnet build src/native/native-clr.csproj` restored packages but could not reach native compilation because this worktree lacks `xa-prep-tasks.dll` and `Xamarin.Android.Tools.BootstrapTasks.dll`. The complete native host build and repository device regression suite have **not** been run for this revision; the locally built SDK is unavailable. Binary measurements have not been repeated. The original branch's reported full native builds and binary measurements remain historical, not validation of this revision.