fix: stop a replaced React Native instance from reporting downloads and restarting

[floyd-soomgo]

Summary

Reloading the app while an update is still downloading crashes it, on both platforms.

A reload starts the next React Native instance before the one it replaces has finished
being torn down. A download in flight keeps the CodePush module of the outgoing instance
alive across that boundary, and its progress callback then reaches an event emitter whose
runtime is gone.

This adds a per-instance liveness flag, cleared when the instance is invalidated, and
returns early from every path that would report to or restart a runtime that is no longer
there.

• iOS — adopt RCTInvalidating, guard dispatchDownloadProgressEvent, loadBundle
  and restartAppInternal:, and invalidate the suspend timer and the resume observers in
  invalidate, so neither can restart the instance that replaced this one.
• Android — guard emitDownloadProgressEvent, which every progress event routes
  through, including the ones a frame callback delivers after teardown. invalidate()
  shuts the background executor down, but a callback already posted to the process-wide
  ReactChoreographer runs regardless. restartAppInternal is guarded the same way.
• E2E — add a standalone scenario that taps "Check for updates" and then "Restart app"
  mid-download, and throttle archive responses in the mock server so the reload lands
  while the download is still running.

The library holds no JSI objects of its own, so the crash is not the one a pure JSI module
would hit. The condition behind it is the same, and CodePush is more exposed than most
because it is what triggers the reload.

The crash

Both platforms abort with the same signature, a destroyed unordered_map whose bucket
count no longer makes sense:

iOS — EXC_CRASH (SIGABRT)

-[CodePushDownloadHandler connection:didReceiveData:]
-[CodePush downloadUpdate:...]_block_invoke
-[CodePush dispatchDownloadProgressEvent]
-[NativeCodePushSpecBase emitOnDownloadProgress:]
  unordered_map<string, shared_ptr<IAsyncEventEmitter>>::operator[]
  __hash_table::__rehash_unique -> std::__next_prime
  std::__throw_overflow_error -> abort

Android — FATAL EXCEPTION: main

java.lang.RuntimeException: __next_prime overflow
  CxxCallbackImpl.nativeInvoke
  NativeCodePushSpec.emitOnDownloadProgress
  CodePushNativeModule.emitDownloadProgressEvent
  ...doFrame
  ReactChoreographer
  android.view.Choreographer$CallbackRecord.run

How it is reached in practice

The window is narrow: the reload has to land before the download finishes, which the
ordinary sync flow never does because it restarts after the download completes. These do
reach it:

• an app calling restartApp() on its own, from a "restart now" control, while a
  background sync downloads
• disallow() then allow() releasing a queued restart during a download
• an ON_NEXT_RESUME or ON_NEXT_SUSPEND update from an earlier session restarting the
  app while a later sync is downloading
• any other reload in the app, such as DevSettings.reload() or a reload on a locale or
  auth change
• Fast Refresh in a development build

Verification

Reproduction, npx tsx e2e/repro-reload-race.ts --app RN0840 --platform <ios|android>:

	before	after
iOS, simulator, new architecture	SIGABRT, 2 runs out of 2	passes, no crash report written
Android, Pixel emulator API 36, new architecture	FATAL EXCEPTION	passes, no fatal exception

Regression, npm run e2e -- --app RN0840 --platform both: all 7 phases pass on both
platforms, 0 failures. Phase 4 covers the resume and suspend install modes that depend on
the observers and timer invalidate now releases, and phase 6 covers answering taps while
a patch downloads and applies.

Also npm run jest (11 suites, 102 tests) and
:bravemobile_react-native-code-push:compileReleaseJavaWithJavac.

Notes

With the guard in place, a reload during a download ends that download in an
InterruptedIOException on Android, which is what shutting the executor down is meant to
raise. It is logged and rejects its promise, and reaches the general catch rather than the
invalid-update one, so no package hash is recorded as failed.

Not addressed here: CodePush.mCurrentInstance on Android is a process-wide singleton that
loadBundleLegacy() clears through invalidateCurrentInstance(), which an outgoing
instance could use to clear the reference its replacement owns. That path only runs when
the reflection-based reload fails, and it is unrelated to this crash.