[browser][CoreCLR][R2R] RuntimeAsync_WhenAny_TracksAllBranches traps in an R2R-to-interpreter transition

### Description

Completing the browser CoreCLR R2R Tasks test investigation exposed a separate execution trap in `AsyncProfilerTests.RuntimeAsync_WhenAny_TracksAllBranches`. It reproduces both in a group and in isolation with aggressive trimming enabled and only `TestUtilities.dll` excluded from R2R. The same test passes with R2R disabled.

This is tracked separately from the missing profiler identities (#133626) and the resumed managed exception escape (#133625): the observed failure is a Wasm memory-access trap during an R2R-to-interpreter transition, not an assertion or `InvalidOperationException`.

### Reproduction Steps

Using the browser CoreCLR library-test pipeline with Release runtime/host/packs and host crossgen2 built:

```sh
XHARNESS_COMMAND=test-browser ./dotnet.sh build /t:Test \
src/libraries/System.Runtime/tests/System.Threading.Tasks.Tests/System.Threading.Tasks.Tests.csproj \
/p:TargetOS=browser /p:TargetArchitecture=wasm /p:RuntimeFlavor=CoreCLR \
/p:Configuration=Release /p:EnableAggressiveTrimming=true /p:PublishReadyToRun=true \
/p:Scenario=WasmTestOnChrome /p:InstallChromeForTests=true /p:XunitShowProgress=true \
/p:WasmXHarnessTestsTimeout=00:03:00 \
/p:WasmTestAppArgs="-method System.Threading.Tasks.Tests.AsyncProfilerTests.RuntimeAsync_WhenAny_TracksAllBranches"
```

The pipeline sets `TEST_READY_TO_RUN_MODE=1` and `PublishReadyToRunExclude=TestUtilities.dll`; the runtime libraries and Tasks assembly stay R2R. Remove only this method's temporary ActiveIssue annotation once applied. For the interpreter control, set `PublishReadyToRun=false` without changing aggressive trimming, forcing Tasks-only relinking to avoid stale incremental assets.

The runtime-async marker starts three runtime-async tasks (one yielding, two using Task.Delay), awaits `Task.WhenAny(fast, slow1, slow2)`, then awaits `Task.WhenAll(slow1, slow2)`.

### Expected behavior

The method should complete without a Wasm trap. Any subsequent profiler-identity assertions are separately covered by #133626.

### Actual behavior

The isolated ON run discovers and starts one case, then exits without final XML/results:

```text
[STRT] System.Threading.Tasks.Tests.AsyncProfilerTests.RuntimeAsync_WhenAny_TracksAllBranches
DOTNET: Unhandled error: memory access out of bounds
RuntimeError: memory access out of bounds
at InterpExecMethod(InterpreterFrame*, InterpMethodContextFrame*, InterpThreadContext*, ExceptionClauseArgs*)
at ExecuteInterpretedMethod
at ExecuteInterpretedMethodWithArgs_PortableEntryPoint(...)
at WasmR2RToInterpreterThunk(iiaS8p)
at WasmDelayLoadHelper->EagerImports->SignaturePointer_ReadyToRunHelper_DelayLoad_MethodCall(...Sig:iiaS8p)
at ...RuntimeAsync_WhenAny_TracksAllBranches_Marker
at WasmInterpreterToR2RThunk(vap)
WASM EXIT 1
```

The grouped run has the same trap at the same test. OFF baseline XML contains one passing result for this exact method. Both ON probes were bounded to three minutes and terminated promptly; this was not a timeout.

### Regression?

Unknown. It is R2R-dependent in the controlled comparison; no earlier release or candidate runtime fix was tested.

### Known Workarounds

`PublishReadyToRun=false`. A method-level `ActiveIssue` conditioned on `PlatformDetection.IsBrowserReadyToRun` can quarantine this case without disabling other tests or interpreter coverage.

### Configuration

macOS arm64 host, single-threaded Chromium 153.0.8010.12, browser-wasm CoreCLR Release development runtime. Tests target net11.0; runtime startup banner reports 12.0.0. Full aggressive trimming remains enabled in both configurations. Reproduced after the #133615 CoreLib/packs rebuild and with TestUtilities interpreted.

### Other information

The precise ABI/transition defect is unproven. The stack identifies the transition and marker, not which argument or frame is malformed. No runtime source changes or speculative prerequisite merges were made. This case was previously masked by earlier AsyncProfiler process aborts.

> [!NOTE]
> This issue was generated by GitHub Copilot from locally reproduced test results.

Start with the browser CoreCLR pipeline command for System.Threading.Tasks.Tests.csproj and isolate AsyncProfilerTests.RuntimeAsync_WhenAny_TracksAllBranches, comparing PublishReadyToRun=true with the stated interpreter control. Trace the marker through WasmInterpreterToR2RThunk and WasmR2RToInterpreterThunk; done means the method completes without a Wasm memory trap while preserving the separate profiler-identity scope.

Written by the indexing model from the issue text.