TextStore: attach-time TSF reentrancy can desync _netCharCount before consistency checks

## Summary
We found a TextStore attach-time reentrancy issue where TSF callbacks can arrive during `TextStore.OnAttach()` before all attach-time state is fully safe, leading to consistency failures in IME-heavy scenarios.

## Observed behavior
`RegisterTextStore` can synchronously re-enter WPF while `OnAttach()` is still running. In this window, attach/focus-time edits can occur before text-change tracking is fully established, and `_netCharCount` can drift from `TextContainer.IMECharCount`.

The resulting failure mode is a later consistency assert/fail-fast path (for example in `VerifyTextStoreConsistency`).

## Repro notes
- We were able to reproduce this deterministically with a custom native TSF Text Input Processor (TIP) test DLL that forces attach/focus-time edit sessions and callback timing similar to third-party IMEs.
- We also observed similar behavior characteristics with WeChat Input Method (a TSF TIP/IME engine).

## Proposed fix direction
In `TextStore.OnAttach()`, subscribe to `TextContainer.Change` **before** `RegisterTextStore`, so registration-time text edits are observed immediately and `_netCharCount` remains synchronized.

(Initialization ordering for callback-facing state should also remain safe before registration.)

## Why this should be considered upstream
This is a TSF callback timing/reentrancy shape that can happen with real third-party IMEs. Fixing the attach-time ordering in WPF TextStore improves robustness for the broader ecosystem, not only a fork-specific scenario.