verify_managed_native_boundaries accepted only inspect_macho exports and
one analyze_function dossier per function, so checking a library's
P/Invokes on a non-macOS host took one engine call per declaration.
It now also accepts inspect_native_exports Evidence: one record supplies
a whole PE export directory or ELF dynamic symbol table. An exact name
verifies only when a by-name lookup binds it; a PE forwarder or an ELF
symbol with only a hidden or unreadable version is inferred with basis
qualified-export-candidate and a limitation naming the reason.
Ordinal-only PE exports match no declaration.
Fixes#4057
Co-Authored-By: Claude Opus 5.5 <[email protected]>
