Project call-target narrowings through stored booleans

[ondrejmirtes]

Summary

• Extends the conditional-expression-holder machinery used when assigning a comparison to a variable (e.g. $ok = $x->foo() !== null) so the narrowing of $x->foo() survives through a later if ($ok) { … }. Previously only Variable, PropertyFetch, ArrayDimFetch and FuncCall sure-type targets were projected, so MethodCall, NullsafeMethodCall and StaticCall were silently dropped.
• For call-typed sure-type targets (FuncCall, MethodCall, NullsafeMethodCall, StaticCall) the projection only fires when the sure-type expression is a sub-expression of the assigned RHS — not the RHS itself. That keeps the narrowing of sub-call $x->foo() in $ok = $x->foo() !== null, while dropping the falsey-scalar loop's $this->nullable() === null-style projections that would otherwise wrongly re-narrow fresh calls after subsequent reassignments (the regression in this playground snippet where line 18 flipped from int|null to null).
• PHPStan virtual nodes (e.g. NativeTypeExpr), scalars and const-fetches are rejected up front so internal nodes don't leak into the conditional-expression map and numeric-string exprStrings don't collide with PHP's array-key autocast.

Test plan

• New NSRT conditional-expr-narrowing-through-variable.php covers the pure-method-call + stored-boolean case and the preg_match(..., $matches) by-ref case (variable narrowing must survive even when the RHS has impure points).
• New NSRT try-catch-reassign-method-narrowing.php locks in the playground snippet: inside a catch block, \$device = \$this->nullable(); must be int|null, not null — the original conditional holders from the first \$device = \$this->nullable() must not leak past the reassignment.
• Full tests/PHPStan/Analyser/NodeScopeResolverTest.php: 1532/1532.
• tests/PHPStan/Analyser/ + tests/PHPStan/Rules/: 5646 tests, 59 pre-existing skips, 0 failures.

🤖 Generated with Claude Code

closes phpstan/phpstan#9455
closes phpstan/phpstan#5207