Crashlytics: NSInvalidArgumentException `-[NSNull lastPathComponent]` in `-[FIRCLSSymbolResolver updateStackFrame:]` (FIRCLSSymbolResolver.m:171)

### Description

Crashlytics itself crashes while symbolicating stack frames ("crash inside the crash reporter"). In `-[FIRCLSSymbolResolver updateStackFrame:]` the binary image path is read from the recorded session data and passed to `lastPathComponent` without a type check:

```objc
// Crashlytics/Crashlytics/Models/FIRCLSSymbolResolver.m:171 (tag 11.14.0; identical on main)
[frame setLibrary:[[binaryImage objectForKey:@"path"] lastPathComponent]];
```

When the recorded `"path"` value is JSON `null`, deserialization yields `NSNull`, which does not respond to `lastPathComponent`:

```
NSInvalidArgumentException: -[NSNull lastPathComponent]: unrecognized selector sent to instance
-[FIRCLSSymbolResolver updateStackFrame:] FIRCLSSymbolResolver.m:171
```

The line has been unchanged since the 2020 open-source import (#4610) and carries no nil/NSNull guard through current `main`; `Crashlytics/CHANGELOG.md` has no related entry.

### Reproducing the issue

Not deterministically reproducible from app code: the crash is secondary — it fires when the SDK symbolicates previously recorded frames whose binary image entry carries a null `path`.

### Firebase SDK Version

11.14.0

### Xcode Version

26.6

### Installation Method

CocoaPods

### Firebase Product(s)

Crashlytics

### Targeted Platforms

iOS

### Relevant Log Output

```shell

```

### If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

```json

Replace this line with the contents of your Package.resolved.

```

### If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

```yml

Replace this line with the contents of your Podfile.lock!

```

Read Crashlytics/Crashlytics/Models/FIRCLSSymbolResolver.m at line 171, then trace how recorded session data populates binaryImage. Identify the existing Crashlytics test entry point for coverage of a JSON-null path. Done means symbolication handles a null path without a secondary exception and the relevant regression test passes.

Written by the indexing model from the issue text.