Build closure and arrow function types from the single rule body walk

[ondrejmirtes]

A closure or arrow function passed through the analyser had its body walked several times: once by processClosureNode()/processArrowFunctionNode() for the rules, and again by every getClosureType() pricing ask — the lazy handler resolveType(), the invalidate-expression reads in processArgs(), and the native-flavour ask each re-walked unless a whole-scope cache key happened to collide. This PR makes the pricing asks answer from the rule walk:

• ProcessClosureResult carries the gathered return/yield statement-scope pairs, execution ends, and impure points (pre-merged in getClosureType() order); the new ProcessArrowFunctionResult carries the walked arrow scope and the type-relevant points.
• ClosureTypeResolver gains buildClosureTypeForClosure()/buildClosureTypeForArrowFunction(), which construct the same ClosureType from the gathered data — reading the return/yield types off the gathered scopes, natively via the promoted flavour when asked — and getClosureType() now shares their whole tail (parameter building with defaults priced through InitializerExprTypeResolver, the never/void derivation, Generator shape, assembly + cache write). array_map() callbacks and immediately invoked closures keep walking in getClosureType() because their parameters are typed from the call site.
• The handlers and the processArgs() argument branches seed the per-node type cache from the walk they just performed. The cache key becomes parameter-aware, and flavour-separated for arrow functions (whose native return type genuinely differs); a closure's native type equals its phpdoc type, so its native-flavour slot is seeded with the same build — making that equality deliberate where it previously depended on a scope-hash collision.
• Fiber-completeness contract preserved: the gathered arrays fill in by reference and are complete only once pending fibers flush (#14888's fix reads the invalidate expressions off the flushed ClosureType for exactly this reason). All seeding is gated on the storage having no parked fibers, and the two protected reads in processArgs() are textually untouched — they become cache hits in the common case and keep re-walking flushed when anything is parked.

Zero expectation churn: full test suite green in both turbo modes (17844 tests), self-analysis and CS clean. No turbo-shadowed class is touched, so no extension bump.

Follow-up (separate PR): shallow closure/arrow scope entry (enterAnonymousFunction() currently re-walks the body to build the reflection) with the refined-type swap for ClosureReturnStatementsNode/InArrowFunctionNode, and the free-variable-slice cache key that makes seed hits robust against unrelated scope changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DaBZjgksga4c5s6Q9FniY7

[ondrejmirtes]

Benchmark: commit-toggled ABBA, same tree, no-turbo, bin/phpstan analyse src/Analyser src/Rules with cleared result cache, user CPU, 6 pairs (machine at load ~6, moderately noisy):

• base (2.2.x): median 51.00s — [47.31, 49.00, 50.97, 51.03, 51.44, 54.80]
• this PR: median 50.08s — [49.58, 49.73, 49.89, 50.27, 52.12, 52.90]
• delta −1.80% median; paired mean diff −0.01s (sd 1.63s)

Directionally a win with a visibly tighter spread on the PR side, but the pairing is washed out by machine noise at this n — I can rerun a longer series on a quiet machine if you want a firmer number. The structural claim (pricing asks hit the seeded cache instead of re-walking) is independent of the benchmark.