Add CI coverage for the exported CLRMA `!analyze` path (dbgeng, out of command scope)

## Background

PR #5946 fixed a crash on the native (non-hosted) CLRMA path where the exported `CLRMACreateInstance` (invoked by dbgeng `!analyze` via `ext!CLRMACreateCached`) borrowed command-scoped `g_Ext*` debugger globals that are null outside a `!command`. Regression originated in #4667.

That PR added coverage that exercises the fixed native `Target`/`DataTarget`/`Runtime` object graph via `!clrma` under cdb with `!SetHostRuntime -none`. However, this does **not** reproduce the original crash, because the `!clrma` command runs *in* command scope (`INIT_API_EXT()` -> `ExtQuery` populates `g_Ext*` for the command's duration). The only trigger that runs *outside* command scope is dbgeng's `!analyze`, which we cannot exercise in CI today.

## Why `!analyze` can't be tested in CI currently

- **No `ext.dll` in the test debugger package.** The `cdb-sos` package (`10.0.26100.1`) used by the tests ships only `dbgcore`/`dbgeng`/`dbghelp`/`DbgModel`/`symsrv` - no `ext.dll`, so `!analyze` fails with "No export analyze found". `DbgEngPath` in `Microsoft.Diagnostics.DebugServices.UnitTests.csproj` points at this same package.
- **`TestDbgEng` harness is disabled.** The `true` config blocks in `ConfigFiles/Windows/Debugger.Tests.Config.txt` are commented out (tracked by #3111), so `ClrmaTests`/`BangAnalyzeTests` (the only harness that issues `!analyze`) don't run in CI.

## Ask

Add a test that drives CLRMA through the real out-of-command-scope entry point so the exact `g_Ext*`-null crash path is gated in CI. Options to evaluate:

- Provide an `ext.dll`-capable debugger in the test assets (or a minimal harness) and re-enable a scoped `TestDbgEng` configuration (see #3111) so `!analyze -v` can run against a managed crash dump.
- Alternatively, add a small native test harness that calls the exported `CLRMACreateInstance` + `AssociateClient` directly with no active command (mirroring `ext!CLRMACreateCached`), asserting no fault when the command-scoped globals are null.

## References

- Fix: #5946
- Regression origin: #4667
- Related disabled harness: #3111

Review Microsoft.Diagnostics.DebugServices.UnitTests.csproj and ConfigFiles/Windows/Debugger.Tests.Config.txt, then inspect ClrmaTests and BangAnalyzeTests alongside issue #3111. Evaluate enabling an ext.dll-capable debugger or using a native harness to call CLRMACreateInstance and AssociateClient without command scope. Done means CI exercises the real out-of-command-scope path and gates the g_Ext*-null crash.

Written by the indexing model from the issue text.