fix(types): safely widen object elements for bare array parameters

[chadmandoo]

What

Bare PHP array parameters must not acquire an element-class contract from their first call site. This keeps object elements runtime-dynamic across sibling call sites while preserving associative-array storage shape and the existing scalar element specialization.

The query-builder case remains supported, but without accepting incompatible object arrays globally or lowering the callee body against a stale concrete class.

Root cause

A bare array parameter started as Array(Mixed) and was specialized to the first concrete object element type. Later sibling-object calls were then checked against an Elephc-invented generic bound. The previous workaround accepted those calls in global type_accepts, but left property lowering pinned to the first class and its fixed slot offset, which could read the wrong property or segfault.

How

• Remove the global Array(Object) sibling-object assignability exception.
• At bare-array parameter boundaries only, keep indexed object elements as Mixed; for associative arrays, retain the hash key/storage shape and erase object values to Mixed.
• Preserve concrete scalar array specialization and non-parameter array inference.
• Make Mixed property class dispatch branch to a real miss path instead of falling through to the first candidate.
• On a missing runtime property, emit the PHP-style undefined-property warning and return boxed null on AArch64 and x86_64.

Regression coverage

• query-builder sibling object arrays
• same-offset sibling with a missing property: no silent wrong value
• different-layout sibling with a missing property: no crash
• associative sibling-object arrays preserve hash shape
• existing scalar and method-array parameter specialization remains green

Verification

• cargo build
• focused macOS codegen and error tests
• focused Linux x86_64 Docker regressions
• cargo fmt --check and git diff --check
• assembly-comment checker adds no debt relative to main