Fix CLR->COM RCW ownership tracking on the slow path

[AaronRobinsonMSFT]

Fixes #126619.

This was a regression introduced in #114609

When System.StubHelpers.GetCOMIPFromRCW() misses the fast path on a native-created thread, the slow path can create OLE TLS and still resolve the COM interface pointer from the RCW cache. Those cache hits are borrowed and should not be released by the stub cleanup path.

This change moves the pfNeedsRelease decision to the slow helper so it can distinguish between:

• RCW cache hits after OLE TLS initialization
• freshly acquired interface pointers from ComObject::GetComIPFromRCWThrowing

Testing:

• verified against the local repro from COM Stub calls Release without calling AddRef when calling void function without parameters when this interface is used from unmanaged threads in .NET 10. Demo project attached. #126619

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes CLR→COM stub cleanup ownership tracking when StubHelpers.GetCOMIPFromRCW() falls back to the slow path on native-created threads, preventing erroneous Release calls for RCW-cache hits after OLE TLS initialization (issue #126619).

Changes:

• Extend the QCall slow helper (StubHelpers_GetCOMIPFromRCWSlow) to return an explicit pfNeedsRelease flag.
• Update the slow helper implementation to set pfNeedsRelease=true only for freshly acquired COM IPs (and keep it false for RCW-cache hits).
• Update managed StubHelpers.GetCOMIPFromRCW to delegate pfNeedsRelease determination to the slow path.

Show a summary per file

File	Description
src/coreclr/vm/stubhelpers.h	Updates the slow-path QCall signature to include an explicit ownership/cleanup flag.
src/coreclr/vm/stubhelpers.cpp	Implements ownership tracking: cache hits return borrowed pointers (no release), fresh acquisitions require release.
src/coreclr/System.Private.CoreLib/src/System/StubHelpers.cs	Plumbs pfNeedsRelease through the slow path so cleanup behavior matches actual pointer ownership.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 1

[AaronRobinsonMSFT]

@elinor-fung @jkoritzinsky I've added a test here. It was a bit complicated and I wasted about an hour trying to reason why other tests were failing. Apparently Copilot missed the semantic meaning of IAgileObject which made the STA logic being used for the tests really flakey. I can't get too upset though, IAgileObject is a bit niche.