[SunSi12138]

Summary

Implements #762's structural generated UnsafeBlit path for 3.0.

• FinalUnsafeBlitCodecPlan now emits an owner-local factory carrying its explicit pointer-width and framework raw-ABI requirement. The Abstractions-only generated provider capability validates it directly in Runtime.
• Generated resolution never consults a process Type catalog or a standalone resolver. Missing generated metadata fails closed. Existing manifest-generation ownership remains authoritative.
• Remove arbitrary unmanaged reflection fallback, the public UnsafeBlit catalog, publish-mode preprocessor flag, feature switch, embedded linker substitution, and package trim suppressions.
• Add ProjectReference partial-trim coverage alongside full trimming, and retain the existing NativeAOT/package/mobile gates. Runtime is not globally marked trimmable.
• Keep raw wire layout and CodecHash semantics unchanged; builtin codecs/enums and explicit codec/resolver registration remain supported.

Explicit 3.0 decision / migration

The maintainer explicitly chose to delete the unmanaged reflection fallback entirely and not ship an optional reflection package. This supersedes the original issue's request to preserve automatic untrimmed-JIT fallback. Unregistered arbitrary unmanaged types now fail in JIT too.

Standalone SharpLinkRuntimeContextBuilder.AddCodec / UseCodecResolver remain unchanged. They are not client/server AddCodec APIs and do not override generated RPC owner policy; generated custom encoding still uses compile-time RpcCodec/Adapter binding. See migration and ADR.

Package version is 3.0.0. Generated API increments once from published v2.0.3/API4 to API5, with exact identity sharplink-3.0-api5-owner-bound-unsafe-blit-v1. The release calibration uses the actual published v2.0.3 commit and retains the original increment/unchanged guard policy. Different API5 development identities are rejected; this does not include #754's independent method-shape work. The new 3.0 public API baseline changes only Abstractions; seven other package surfaces are unchanged.

Owner-provenance correction

The reviewed public-capability bypass is fixed: raw codec creation requires the exact admitted factory instance, snapshotted target Type and ABI, and receiving owner's active scope. Contract bindings shadow global bindings. The guard performs no factory callback, dependency lookup or fallback.

Generated raw factories are registered directly because they already carry the finalized CodecHash; an identity-only decorator must not replace the admitted instance. A compiled real-manifest regression checks the emitted identity hash and codec roundtrip through global and owner resolution, in addition to unregistered-type, forged-ABI, wrong-Type, cross-owner/generation, scope, mutation and disposal regressions. Independent source review found no remaining blocker.

Exact-head validation

Source head: 7027f8fbd6ffa30e10c27ac0c501ff22f7083144.

• PR Fast: passed, including formatting, maintainability and allocation gates.
• Canonical full Quick: 32/32 jobs passed. Unit 2038/2038, generator 271/271, load-test 77/77, integration 453/453; NativeAOT transport/topology, package, demo, load and chaos smokes passed.
• That Quick run uses an isolated validation-only branch. Only two workflow files differ; all 12 checkout sites assert a clean exact-source checkout and artifact provenance is pinned to the same source head.
• PR Package Smoke: passed source ProjectReference full + partial trimming, isolated NativeAOT, package contracts, packaged JIT/full-trim/partial-trim/NativeAOT, late-set trim configuration and Quick Start consumption.
• Canonical desktop/browser codec evidence passed for Windows/Linux/macOS x64/arm64 and browser variants.
• UnsafeBlit layout, padding security and CodeQL: passed.
• Mobile evidence: desktop reference, Android CoreCLR x64 emulator, blocking iOS CoreCLR x64 simulator, experimental iOS CoreCLR arm64 simulator and mobile summary all passed.

Earlier failed runs were fixed without lowering gates. The previous-head arm64 verification timeout is superseded by this head's completed arm64 pass. Local sandbox IPC restrictions prevented full local transport/trim/format runs; hosted evidence above covers those checks. No global Runtime trimmability or trim suppression was added.

Review and integration

All listed gates passed on this source head. Simulator/emulator results are not physical-device coverage.

Before combining #754 and #762 into 3.0, coordinate one generated identity, generator contract and reviewed public API baseline; shared API5 numbering alone is not compatibility. This PR is ready for review. No merge or release is requested.