llvm-cov report/export segfaults in CoverageMapping::getInstantiationGroups with branch coverage across many object files

## Summary

`llvm-cov report`/`llvm-cov export -format=lcov` crashes with SIGSEGV inside LLVM's own coverage-mapping code (`llvm::coverage::CoverageMapping::getInstantiationGroups`) when reading a `.profdata` file that includes branch-coverage regions (`-fcoverage-mapping` compiled with branch coverage enabled, i.e. `-Z coverage-options=branch` / `cargo-llvm-cov --branch`) and merging results across a large number of `-object` inputs (~140 object files from a multi-crate Rust workspace + its dependency build scripts).

Reproduced on two different LLVM releases bundled with two different `rustc` nightly builds:
- LLVM 23.1.0 (rustc 1.100.0-nightly, `nightly-2026-08-18`)
- LLVM 22.1 (rustc 1.99.0-nightly, `nightly-2026-08-01`)

Both crash identically. Does not reproduce with the same command run without `--branch` (regular line/region coverage only), and does not reproduce on aarch64 macOS with the same LLVM versions — only observed on x86_64 Linux so far, though also independently reproduced by a colleague on their own machine locally (architecture/OS to be confirmed).

## Steps to reproduce

Using `cargo-llvm-cov` (a thin wrapper that invokes `llvm-cov` under the hood) against a real-world multi-crate Rust workspace (~700 tests across several crates, plus example/bench binaries):

```
cargo llvm-cov clean --workspace
cargo llvm-cov nextest --all-features --branch --no-report --no-fail-fast
cargo llvm-cov --no-report --branch --doc --all-features
cargo llvm-cov report # or `report --lcov`/`report --html` -- same crash
```

The last command crashes. Immediately before the crash, `llvm-cov` prints:
```
warning: 9 functions have mismatched data
```
then the SIGSEGV.

## Stack trace (from `llvm-cov report`, LLVM 23.1.0)

```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: llvm-cov "llvm-cov export" -format=lcov -instr-profile=.../scylla-rust-driver.profdata -object ... (~140 -object args) -ignore-filename-regex '...'
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var LLVM_SYMBOLIZER_PATH to point to it):
0 libLLVM.so.23.1-rust-1.100.0-nightly 0x... llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 42
1 libLLVM.so.23.1-rust-1.100.0-nightly 0x...
2 libc.so.6 0x...
3 llvm-cov 0x...
4 llvm-cov 0x...
5 llvm-cov 0x...
6 llvm-cov 0x...
7 llvm-cov 0x...
8 libc.so.6 0x...
9 libc.so.6 0x... __libc_start_main + 139
10 llvm-cov 0x...
```

## Stack trace (from `llvm-cov report`, LLVM 22.1, clearer symbols)

```
warning: 9 functions have mismatched data
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
0 libLLVM.so.22.1-rust-1.99.0-nightly 0x... llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 39
1 libLLVM.so.22.1-rust-1.99.0-nightly 0x...
2 libc.so.6 0x...
3 libLLVM.so.22.1-rust-1.99.0-nightly 0x... llvm::coverage::CoverageMapping::getInstantiationGroups(llvm::StringRef) const + 319
4 llvm-cov 0x...
5 llvm-cov 0x...
6 llvm-cov 0x...
7 llvm-cov 0x...
8 libc.so.6 0x...
9 llvm-cov 0x...
10 llvm-cov 0x...
11 llvm-cov 0x...
12 llvm-cov 0x...
13 libLLVM.so.22.1-rust-1.99.0-nightly 0x... llvm::StdThreadPool::processTasks(llvm::ThreadPoolTaskGroup*) + 595
14 libLLVM.so.22.1-rust-1.99.0-nightly 0x...
15 libc.so.6 0x...
16 libc.so.6 0x...
```

The consistent frame across both LLVM versions is `CoverageMapping::getInstantiationGroups`, called from a thread-pool worker (`StdThreadPool::processTasks`), suggesting this may be a concurrency/thread-safety issue in `getInstantiationGroups` when it runs in parallel across many functions/object files with branch-coverage region data present, rather than a version-specific regression.

## Environment

- OS: `ubuntu-latest` (x86_64 Linux) GitHub Actions runner
- Rust: nightly-2026-08-18 (rustc 1.100.0-nightly, LLVM 23.1.0) and nightly-2026-08-01 (rustc 1.99.0-nightly, LLVM 22.1)
- `cargo-llvm-cov` (latest, installed via `taiki-e/install-action`)
- `cargo-nextest`
- Workspace: ~15 crates, ~700 tests, ~140 object files (binaries + build scripts) passed to `llvm-cov` via `-object`

## What we've ruled out

- Not tied to one LLVM release: identical crash under LLVM 22.1 and 23.1.
- Not architecture-universal: does not reproduce on aarch64 macOS with either LLVM version tested.
- Not present without `--branch`: plain line/region coverage across the same object set works correctly.

## Workaround in use

Not enabling `--branch` (branch coverage) for now; line/region coverage works fine.

Reproduce the crash with the provided cargo-llvm-cov workflow, branch coverage, and the large set of object inputs on x86_64 Linux. Start at llvm::coverage::CoverageMapping::getInstantiationGroups and its thread-pool callers, comparing behavior with branch coverage disabled. Done means report/export no longer segfaults for the described workload and the mismatched-data case is handled safely.

Written by the indexing model from the issue text.