Keep runtime-thread Invoke rejection enabled in Release builds

[yiguodev]

Summary

Fixes #7.

RuntimeThreadGuard::enter() previously performed marker.replace(true) inside debug_assert!. Release builds omit that expression, so runtime-thread Invoke requests bypassed the existing fail-fast admission check.

• Set the marker unconditionally, retaining the debug-only nested-entry assertion and the existing guard cleanup.
• Keep the existing regression test and its expected failure response unchanged.
• Run the full all-features/all-targets suite in both Debug and Release in CI.
• Document that business Invoke reentry is rejected in both profiles, including read-only requests such as version.

No ABI, protocol revision, runtime fallback, or package activation behavior changes.

Validation

Local environment: Windows 11 ARM64, Rust 1.98.1.

• On unchanged base 400f48f, the existing isolated regression passed in Debug and failed in Release (success: true, expected false). It passes in Release after the fix.
• The original full Release scenario (--no-default-features --features ffi --all-targets) passed: 486 passed, 4 intentionally ignored. Follow-on poisoned-mutex failures are gone.
• All-features/all-targets Debug and Release runs each passed: 486 passed, 5 intentionally ignored.
• Formatting and Release Clippy (--all-features --lib --bins -- -D warnings) passed.
• C-header/TLS dependency checks and all 8 script tests passed.
• The standard ARM64 native artifact build passed architecture and build-identity validation; integration revision remains 3.
• Native x64 Windows 2025 CI passed the default-feature build and both Debug and Release test steps.

Representative regression command:

cargo test --locked --release --target aarch64-pc-windows-msvc --no-default-features --features ffi --lib ffi::tests::runtime_thread_cannot_reenter_invoke -- --exact

No application installation, live VPN, or Apple/Android physical-device acceptance was performed. Local results above are ARM64; CI provides the separate native x64 coverage.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.