Narrow types of maybe-set array keys through conditional expression holders

[phpstan-bot]

Summary

When code guards a maybe-set array key with a pattern like:

if (array_key_exists('a', $options) && !is_string($options['a'])) {
    exit(1);
}

PHPStan should know that after this block, if key 'a' exists, its value is string. This enables $options['a'] ?? 'fallback' to resolve to string.

Three changes make this work:

• Cross-process sureTypes/sureNotTypes in conditional holder builders: processBooleanSureConditionalTypes now also iterates rightTypes->getSureNotTypes(), and processBooleanNotSureConditionalTypes now also iterates rightTypes->getSureTypes(). Previously, each method only paired sure-to-sure or sureNot-to-sureNot, missing cross-arm implications like "if array has offset X (from sureNotType), then value at X is string (from sureType)".

• Isset handler produces HasOffsetType for general arrays: In the falsey branch, isset($data['key']) on a non-constant array with non-nullable values now produces a HasOffsetType specification, matching what array_key_exists already does. This enables conditional holders to fire for the isset variant of the pattern. Gated to non-constant arrays to avoid interfering with the existing constant-array handling of optional keys.

• Deep merge for conditional holder arrays: Replaced array_merge with mergeConditionalHolderArrays when combining holders from the four processBooleanXxxConditionalTypes calls. PHP's array_merge overwrites string keys, so a holder from one call would silently replace a valid holder from an earlier call when they targeted the same expression.

Test plan

• New regression test tests/PHPStan/Analyser/nsrt/bug-11918.php covers:
  • array_key_exists + !is_string pattern
  • array_key_exists + !is_int pattern (no assertion on coalesce since int is not in original type)
  • isset + !is_string pattern
  • Negated-or pattern (!array_key_exists || is_string)
  • instanceof pattern (array_key_exists + !instanceof)
• All 12154 existing tests pass
• make phpstan reports no errors
• make cs-fix reports no violations

Closes phpstan/phpstan#11918