Narrow switch case branch from the case condition's plain scope instead of its truthy scope - #5852

Summary

PHPStan reported $i === 0 as "always false" inside a switch case even
though it is reachable at runtime:

/** @param int<0, 5> $range */
public function doFoo(int $i, int $range): void {
    switch ($i) {
        case $range:
            if ($i === 0) { // wrongly reported "always false"
                echo 'zero';
                return;
            }
        case 0:
            break;
    }
}

In the case $range branch PHPStan narrowed $i to int<1, 5> instead of
int<0, 5>, dropping the value 0.

Changes

• src/Analyser/NodeScopeResolver.php: when narrowing a switch case
  branch, start from $caseResult->getScope() instead of
  $caseResult->getTruthyScope() before applying
  filterByTruthyValue($cond == $case).
• tests/PHPStan/Analyser/nsrt/bug-14814.php: new regression test covering
  the reported int<0, 5> range case, the case-condition value itself, and
  the analogous string (''|'a'|'b') case.
• tests/PHPStan/Analyser/nsrt/switch-instanceof-not.php: updated to assert
  the now-correct narrowing (switch (false) { case $foo instanceof Foo: }
  narrows $foo to the non-Foo member of the union instead of producing
  the bogus *NEVER*).
• tests/PHPStan/Rules/Comparison/MatchExpressionRuleTest.php: updated the
  bug-6407 expectation (see Root cause).

Root cause

A switch case case X: is entered when $cond == X — this is completely
independent of whether X is truthy. The branch scope was being taken from
$caseResult->getTruthyScope(), i.e. the scope in which the case-condition
expression is assumed truthy. For a non-boolean case condition this is wrong:

• For a variable case condition (case $range, $range of int<0, 5>), the
  truthy scope narrows $range to int<1, 5>, and the subsequent
  filterByTruthyValue($i == $range) then propagates that to $i, so $i
  loses 0.
• For a falsy literal case condition (case 0, case '', …) the truthy
  scope is contradictory, with the result that the switch subject was not
  narrowed to the case value at all.

The getTruthyScope() call was originally introduced to pick up the
type-narrowing side effects of boolean case conditions in switch (true)
(bug-5326, e.g. preg_match(..., $match) defining $match). Those side
effects are still produced when narrowing from the plain scope, because
filterByTruthyValue($cond == $caseExpr) re-applies the truthy narrowing of
the boolean case condition. bug-5326 continues to pass.

This brings switch in line with match, whose MatchHandler already
narrows arms from $armCondResult->getScope() (not a truthy scope), so the
analogous match (true) { ... } construct never had this bug.

Note on bug-6407

bug-6407's match test previously expected no errors. That expectation
only held because of this same bug: a case 0 (and the other falsy/literal
cases) failed to narrow $packet->type, so the post-switch type stayed
int and the later match looked non-exhaustive. With falsy case values now
narrowing correctly, the subject is 0|1|2|3|4, the match is genuinely
exhaustive, and PHPStan correctly flags the last redundant arm as always true
(the standard behaviour for an exhaustive match carrying a redundant
default). The test was updated to expect that error.

Test

• tests/PHPStan/Analyser/nsrt/bug-14814.php reproduces the reported issue
  and fails before the fix (int<1, 5> instead of int<0, 5>), as does the
  analogous string case ('a'|'b' instead of ''|'a'|'b'), confirming the
  bug is not specific to integer ranges.
• Full suite (make tests), self-analysis (make phpstan) and make cs-fix
  are green. The make name-collision failure on
  tests/PHPStan/Build/data/final-class-rule-pipe.php is pre-existing and
  unrelated to this change.

Fixes phpstan/phpstan#14814