[CI] iOS 27 SpringBoard RBSAssertion crash causes app launch timeout

## Failure signature

An iOS 27 simulator variation launches its app process but never connects to the test listener. XHarness reports a three-minute launch timeout while SpringBoard crashes with:

```text
-[RBSAssertion dealloc]
-[FBScene(PosterUIFoundation) pui_executeSnapshotForDescriptor:...]
PBUIPosterVariantViewController
```

## Confirmed occurrences

| PR / head | Build and job | Variation | Outcome |
|---|---|---|---|
| #26206 / `626ec555b5a6ed30e8c917bd4b3046c0d4f47018` | [14719282 - monotouch_ios](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14719282&view=logs&jobId=a70ed34c-97c9-5ebb-c5be-8e2604f5ffcc) | Debug (PrepareAssemblies, inline dlfcn, dont link) | App never connected after SpringBoard aborted in the RBSAssertion/poster snapshot path. Simulator-tests attempt 2 remains active. |
| #26208 / `34b9f4d4972752561d6769b7f1ef0fbe276e049c` | [14718968 - monotouch_ios, attempt 2](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14718968&view=logs&jobId=a82441db-bb83-5a9b-9451-a8501e963a31) | Release (compat inline Class.GetHandle) | App never connected after the same SpringBoard crash signature. |

First observed: 2026-07-21 19:18 UTC. Latest observed: 2026-07-22 02:08 UTC. Recurrence: 2 variations across 2 distinct monitored PRs.

## Classification and impact

This is a genuinely flaky iOS 27 simulator failure, not a source regression. Sibling variations launch and pass, while the failed variation coincides with a first-party SpringBoard crash in identical framework code.

## Investigation

- Inspected TestSummary, HtmlReport, XHarness run logs, and SpringBoard crash reports.
- Correlated the exact RBSAssertion and PosterUIFoundation stack across both PRs.
- Searched open and closed `dotnet/macios` issues using the crash symbols and launch-timeout text; no matching issue was found.

## Workaround

Rerun the failed simulator job after confirming mergeability and retry budgets. Azure artifacts and crash reports have limited retention.

Start with the TestSummary, HtmlReport, XHarness run logs, and retained SpringBoard crash reports for the two linked build jobs. Compare the RBSAssertion/PosterUIFoundation signatures and simulator variations, then confirm whether a reproducible mitigation or actionable CI handling exists; done means the failure is explained or reliably mitigated rather than merely retried.

Written by the indexing model from the issue text.