fix: prevent async task handle use-after-free

[ralfbiedert]

Summary

• dispose cancellation registrations before freeing native task handles
• prevent cancellation callbacks from calling Abort through a freed Rust TaskHandleInner
• update the generated C# bindings snapshot

Root cause

The generated async wrapper disposed TaskHandle before the using-declared CancellationTokenRegistration. A concurrent cancellation callback could therefore enter TaskHandle.Abort while TaskHandle.Dispose freed the backing Rust Box, causing use-after-free and process-level heap corruption.

Validation

• reproduced as a Windows 0xC0000005 crash in TaskHandle.Abort
• fixed ordering survived 400,000 forced cancellation/completion races
• full C# reference suite passed (185 tests)
• reference-project binding snapshot generation passed