[CI] NativeAOT CGImageMetadataTest crashes retaining CGImageMetadataTag proxy

## Summary

`MonoTouchFixtures.CoreGraphics.CGImageMetadataTest.EnumerateMetadata` intermittently crashes in NativeAOT while constructing and retaining a `CGImageMetadataTag` proxy returned by `CGImageMetadataEnumerateTagsUsingBlock`.

- Stable signature: `iOS simulator NativeAOT CGImageMetadataTest.EnumerateMetadata crashes in CGImageMetadataTag proxy retain (objc_retain EXC_BAD_ACCESS/SIGSEGV)`
- Classification: genuine intermittent NativeAOT interop/product crash
- Distinct monitored PRs: 2
- Confirmed occurrences: 3
- First retained occurrence: 2026-09-01
- Latest occurrence: 2026-09-02T18:16:42Z

## Confirmed occurrences

### PR #26424

Two different heads reproduced the same crash:

- Head `f4d27dbb1d3365e1729bf029041aac72cb8c28cb`, [build 15118520 attempt 1](https://dev.azure.com/devdiv/DevDiv/_build/results?buildId=15118520), `T: monotouch_ios`.
- Head `f405da213809a39a7ae21ec5391237633659b77c`, [build 15157901 attempt 1](https://dev.azure.com/devdiv/DevDiv/_build/results?buildId=15157901&view=logs&j=a70ed34c-97c9-5ebb-c5be-8e2604f5ffcc), `T: monotouch_ios`.

A later #26424 head completed its simulator build successfully and the PR merged, consistent with an intermittent failure rather than a deterministic merge regression.

### PR #26539

- Head: `a279fec7a28ee8515c20640c2c78c7ec8ad11c28`
- [Build 15185386 attempt 1, `T: monotouch_ios` / Run tests](https://dev.azure.com/devdiv/DevDiv/_build/results?buildId=15185386&view=logs&j=a70ed34c-97c9-5ebb-c5be-8e2604f5ffcc&t=113cecf5-45b6-5477-24c3-52ec12451502)
- Worker: `AcesShared 159`
- Configuration: iOS simulator Release, trimmable static registrar, NativeAOT
- Simulator: iPhone 14 / iOS 26.5
- Exception: `EXC_BAD_ACCESS`, `SIGSEGV`, invalid address in `objc_retain`
- Faulting stack:
- `objc_retain`
- `CFObject.CFRetain`
- `NativeObject.Retain`
- `CGImageMetadataTag` proxy `CreateObject`
- `Runtime.ConstructINativeObject`
- `Runtime.GetINativeObject`
- `CGImageMetadata.TagEnumerator`
- `CGImageMetadataEnumerateTagsUsingBlock`
- `CGImageMetadataTest.EnumerateMetadata`

PR #26539 only changes AppKit enum documentation and documentation-test baselines, which are unrelated to CoreGraphics, ImageIO, or NativeAOT object construction.

## Impact and reproduction pattern

The crash terminates the entire NativeAOT test application, loses the rest of that configuration’s test results, and fails `monotouch_ios`. The same managed test and native proxy-retain stack have occurred on multiple heads and unrelated PRs.

## Investigation

The Azure timelines, TestSummary and HTML artifacts, raw `.ips` crash report, faulting-thread image map, retained occurrence ledger, PR file lists, and later passing build progression were compared. The newest run also contains a separate NativeAOT `CTLineTests.EnumerateCaretOffsets` Objective-C cache abort; that is a different signature and is not grouped here.

Separate searches across every open and closed issue used the exact test name, `CGImageMetadataTag`, `objc_retain`, `CGImageMetadataEnumerateTagsUsingBlock`, proxy construction, and NativeAOT terms. No matching issue was found.

## Current diagnosis and workaround

The native callback supplies a metadata-tag handle that is invalid by the time the generated proxy path calls `CFRetain`/`objc_retain`, or its ownership classification is intermittently incorrect. The exact lifetime transition is unresolved.

The current workaround is an evidence-backed simulator-stage retry when the parent run is terminal and no deterministic failure would be rerun. Useful follow-up diagnostics would record the callback-provided handle, ownership flag, native type, proxy creation path, and retain timing before dereferencing it.

Azure logs and artifacts are retention-limited.

Start with MonoTouchFixtures.CoreGraphics.CGImageMetadataTest.EnumerateMetadata and the NativeAOT faulting stack in the linked Azure artifacts. Compare the callback-provided handle, ownership information, proxy construction path, and retain timing, as suggested by the issue. Done means identifying the lifetime failure, implementing a reliable fix, and confirming the test no longer crashes in the iOS simulator NativeAOT configuration.

Written by the indexing model from the issue text.