[CoreCLR] MarshalMethodsAppRuns crashes in Java_mono_android_TypeManager_n_activate

## Android framework version

- `net11.0-android` (Preview)

## Affected platform version

- `dotnet/android` PR pipeline definition 333 on 2026-07-21–22
- Android x64 emulator
- CoreCLR
- The newest public artifact uses .NET SDK `11.0.100-preview.7.26365.101`

## Description

`MarshalMethodsAppRuns(CoreCLR)` is repeatedly crashing during unrelated PR builds.
In a sample of 12 distinct PRs targeting `main`, the test failed in 6 PRs. Five
public test artifacts contain the same native null-dereference; the sixth run
timed out without producing the startup marker.

The test reports:

```text
Failed MarshalMethodsAppRuns(CoreCLR)
Output did not contain XXX:OnStart done!
```

In the five crash artifacts, logcat shows that the app did not merely miss the
expected log line—it crashed during startup:

```text
Got a SIGSEGV while executing native code.
Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0

#01 ... libxamarin-app-clr.so
Java_mono_android_TypeManager_n_1activate+73
```

The same signature appeared in these distinct PR builds:

- [build 1520924 / PR 12203](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1520924)
- [build 1520526 / PR 12199](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1520526)
- [build 1520455 / PR 12148](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1520455)
- [build 1519810 / PR 12193](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1519810)
- [build 1520229 / PR 12200](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1520229)

The latest occurrence is available in the public
[MSBuild+Emulator 3 test artifact](https://dev.azure.com/dnceng-public/public/_apis/build/builds/1520924/artifacts?artifactName=Test%20Results%20-%20MSBuild%20With%20Emulator%20-%20macOS-3%20&api-version=7.1&%24format=zip);
the signature is in
`MarshalMethodsAppRunsCoreCLR/logcat-failed.log`.

[Build 1520448 / PR 12195](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1520448)
also failed the same test, but its artifact shows an accepted Activity launch with
no app-process/CoreCLR output before the approximately four-minute timeout. That
run is not counted among the five confirmed native crashes.

### Related but distinct work

- [dotnet/android#12201](https://github.com/dotnet/android/issues/12201)
tracks a physical-arm64 incremental Fast Deploy typemap mismatch after a C# edit.
These CI crashes happen in the existing clean `MarshalMethodsAppRuns(CoreCLR)`
device test on an x64 emulator and have a different native signature.
- [dotnet/android#12195](https://github.com/dotnet/android/pull/12195) and
[dotnet/android#12196](https://github.com/dotnet/android/pull/12196) address
logcat-monitor timing. The public artifacts above contain an actual process
`SIGSEGV`, so the recurring failure is not only a missed startup log line.

## Steps to reproduce

No standalone local reproduction has been reduced yet.

1. Run the `dotnet-android` PR pipeline against an unrelated change targeting
`main`.
2. Inspect `macOS > Tests > MSBuild+Emulator 3`.
3. Run `MarshalMethodsAppRuns(CoreCLR)` on the Android x64 emulator.
4. Inspect `logcat-failed.log` when the test does not observe
`XXX:OnStart done!`.

Across the sampled PRs, this reproduced as the identical native crash in five
distinct runs.

## Expected behavior

The CoreCLR marshal-methods app starts and writes `XXX:OnStart done!`.

## Actual behavior

The app intermittently receives `SIGSEGV` at address `0x0` in
`Java_mono_android_TypeManager_n_1activate+73` before startup completes.

## Workaround

None known.