Avoid treating an empty short assertion bitset as uninitialized during global assertion propagation. Global AP can still prove PHI values non-null by walking predecessor edge assertions, so the MayBeUninit guard should only short-circuit local assertion propagation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Two host-independent leaks of an uninitialized ASSERT_TP were causing
crossgen2 output to differ between 64-bit and 32-bit hosts (and were
hidden by an overly aggressive MayBeUninit short-circuit in
optAssertionIsNonNull):

1. optVnNonNullPropCurStmt creates 'ASSERT_TP empty = BitVecOps::UninitVal()'
   and passes it through optAssertionIsNonNull into optAssertionVNIsNonNull.
   In short-rep an empty bitset is indistinguishable from uninit, so the
   bail-out incidentally worked on 64-bit hosts; on 32-bit hosts the bitset
   was long-rep and the same input was treated as non-empty, producing
   different codegen (and an assertion fire once the bail-out was loosened).
   Substitute MakeEmpty for uninit at the global-AP call site so the iter
   walks a valid empty bitset.

2. optGetEdgeAssertions reads bbAssertionOut / bbJtrueAssertionOut[bbNum]
   for predecessor blocks. Blocks added after optInitAssertionDataflowFlags
   have no valid entry (bbJtrueAssertionOut is sized to fgBBNumMax+1 at
   init time, and bbAssertionOut shares storage with bbCseOut so its
   contents are stale rather than nullptr). Capture optDataflowBBNumMax
   at init time and treat any predecessor whose bbNum exceeds it as
   carrying no assertions.

With both fixes, all 257 framework assemblies produce identical R2R
output when crossgen2 runs on linux-x64 vs linux-arm targeting
linux-arm, including the 13 assemblies that previously diverged.

See dotnet#128602.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>