Use genuine falsey narrowing (not the inverted truthy narrowing) for the consequent of BooleanAnd false-context conditional holders

[phpstan-bot]

Summary

After if ($pendingValue !== null && $submitted === $pendingValue) { return; },
a subsequent if ($pendingValue !== null && $submitted === null) wrongly reported
Strict comparison using === between null and null will always evaluate to true
(identical.alwaysTrue). PHPStan incorrectly narrowed $submitted to null once
$pendingValue was re-narrowed to non-null. This is a regression introduced in
v2.2.2 by the cross-kind conditional holder work for isset()
(#5760 / commit 4910296). The fix keeps that isset() improvement while no
longer fabricating an unsound consequent narrowing for comparisons.

Changes

• src/Analyser/ExprHandler/BooleanAndHandler.php: in the false context, the
  per-arm narrowings that feed processBooleanConditionalTypes are now split into
  two sets:
  • antecedent (condition) types — keep the truthy-narrowing-swap fallback
    used for isset() on array dim fetches ($leftCondTypes / $rightCondTypes);
  • consequent (holder) types — use only the genuine falsey narrowing of the
    arm, including the existing mixed truthy-and-false re-derivation
    ($leftHolderTypes / $rightHolderTypes).
    The four processBooleanConditionalTypes calls now pass the condition set as the
    antecedent and the holder set as the consequent.
• tests/PHPStan/Analyser/nsrt/bug-14828.php: regression test with assertType
  for the reported variable case plus the analogous integer-comparison and
  property-fetch cases.

Root cause

The false-context conditional holders model the disjunction
!(A && B) = !A || !B as implications such as "if A is true, then !B". The
consequent must be B's genuine falsey narrowing. #5760 added a fallback that,
when an arm's falsey narrowing was empty, derived narrowings by swapping the
arm's truthy sure/sureNot types — needed so isset($arr['x']) (whose falsey
narrowing doesn't track the dim fetch) still produces a usable holder.

That swap is only sound for the antecedent: processBooleanConditionalTypes
inverts the antecedent set back into the truthy narrowing, so swap-then-invert is
a no-op. But the same swapped set was also used as the consequent, where it is
taken as-is. For $submitted === $pendingValue, the genuine falsey narrowing is
correctly empty (a !== against a non-constant string does not narrow), so the
swap kicked in and produced $submitted not-string; removing string from
string|null left null. The general fault: inverting a comparison's truthy
narrowing (which narrows to the broad type of the other operand) is not a valid
falsey narrowing unless the predicate's truthy condition is also sufficient (true
for isset/empty/constant ===, false for === against a non-constant).

By using the genuine falsey narrowing for the consequent, an arm with no sound
falsey narrowing simply contributes no consequent.

Test

tests/PHPStan/Analyser/nsrt/bug-14828.php asserts (all three fail before the fix
with Actual: null):

• brokenWithGuard() — the reported ?string case: $submitted stays
  string|null.
• intCase() — analogous ?int case: $b stays int|null.
• propertyCase() — analogous nullable-property case: $c->q stays
  string|null.

The || dual was probed ($a === null || $b !== $a truthy) and found already
correct — the BooleanOr truthy path never used the truthy-swap fallback.

Existing tests for the isset()/empty() improvement (bug-14455, bug-6202,
bug-10644, bug-11918, bug-3385, and the negated/mixed boolean-and-conditional-holder
fixtures) continue to pass.

Fixes phpstan/phpstan#14828