fix(ir_lower): widen mismatched array/array branch merges to boxed mixed

[mirchaemanuel]

Summary

Fixes #549 — match arms (and ternary / ?? / ??= merges) returning indexed arrays with different element types merged to a single element type; reading the other arm's array through the merged type misinterpreted the slot bytes (SIGSEGV on current main when the int arm is read as strings).

Root cause

Two cooperating gaps:

• wider_type_for_merge resolved (Array, Array) and (AssocArray, AssocArray) as right.clone() — the last arm's element type won wholesale.
• coerce_value_for_temp performed no container conversion, so the other arm's runtime array was stored raw and merely relabeled; element reads then decoded the wrong slot width/content (int slots read as string {ptr,len} pairs → fault in __rt_str_persist).

Fix

• wider_type_for_merge now merges array/array and assoc/assoc elementwise, reusing the heterogeneous-literal rules (merge_ir_indexed_element_type / merge_ir_assoc_value_type): equal reprs keep the type, Never/Void yields the other side, any mismatch widens to boxed mixed.
• The merge-temp store path routes containers through a new widen_container_value_for_temp helper: typed containers stored into Mixed-payload temps box their slots via the existing ArrayToMixed / HashToMixed ops. Borrowed and provisionally-owned sources are retained first so the conversion's copy-on-write split rewrites a private copy (per the PR fix(ir): release the producer's reference when boxing an owned value as Mixed (#484) #489 ownership rules); whole-boxed ?array cells flowing through ?? unbox with the owned-payload coercion before converting when the cell does not own its payload, so a caller's live array is never rewritten in place.
• lower_array_to_mixed / lower_hash_to_mixed pass null and in-band null-container sentinels through unconverted on both targets (call-site guard, issue fix(codegen): guard container consumers against the null-container sentinel (chained-read miss segfault) #533 convention), so a missed read forwarded by an arm is never dereferenced.

This fixes match, full ternary, short ternary, ??, and ??= in one place — they share the same merge/store helpers. Target-neutral: AArch64 and x86_64 emissions for both guards.

Tests

18 regression tests in tests/codegen/control_flow/{match_expressions,ternary,nulls}.rs: both arm orders for match and ternary, assoc value-type mismatch, empty-array arm, nested arrays, variable (borrowed) arms, missed-read sentinel forwarding, and ?? with a ?array value side — owning and borrowed cells, including a live caller array passed twice and a 20-iteration loop — with heap-clean assertions under --heap-debug. Focused neighbor suites are green locally on macOS ARM64 (match 151, ternary 45, coalesce 63, nulls 32, plus array/hash/assoc/spread/optimizer filters, ~1,600 tests). The issue's repro prints PHP-parity output on both arms.

Notes

• The sentinel null-identity gap for merged missed reads ($r === null where PHP sees null) is pre-existing (Checker narrows ?T after instanceof but not after an === null guard with early exit #508 family) and unchanged here — this PR guarantees crash-freedom and ??-fallback parity for that shape.
• x86_64 emissions mirror in-file idioms and are compile-verified locally; counting on CI for the Linux matrix.

[mirchaemanuel]

Follow-ups from the adversarial review of this fix, all verified pre-existing on main (none are regressions of this PR): #585 (unguarded null-container sentinel in __rt_mixed_array_get on ternary-forwarded missed reads), #586 (merge temp leaks when read through ?? default), #587 (checker types heterogeneous merges as mixed, rejecting valid array uses that now run correctly at runtime).

[nahime0]

Maintainer follow-up after the current-main refresh:

• Merged current origin/main (40737447b) into the branch in 8b81946cd, bringing the PR across the large EIR migration without conflicts.
• Re-reviewed the implementation against match arms returning arrays with different element types merge to a single element type: reading the other arm's array segfaults #549. The fix is a root-cause contract correction: merge typing widens indexed/associative array payloads elementwise, merge-temp materialization performs the matching ArrayToMixed / HashToMixed conversion, and borrowed/provisional owners are retained so COW preserves live source arrays. The shared merge/store path covers match, ternary, ?:, ??, and ??=.
• Updated docs/php/types.md to remove the now-fixed indexed-array incompatibility and kept only the existing int/bool divergence.
• Added the match arms returning arrays with different element types merge to a single element type: reading the other arm's array segfaults #549 entry under [Unreleased] and removed the stale array-divergence claim from the earlier match with heterogeneous mixed arms (object/array/string) dies at runtime coercing the object arm to string #488 changelog entry (df2608fe6).
• Confirmed Missed array read forwarded through a ternary merge segfaults in __rt_mixed_array_get (unguarded null-container sentinel) #585, Reading a match-merge result through ?? default leaks the merged container on every iteration #586, and Checker types a heterogeneous array/array merge as mixed, rejecting valid array uses (by-ref, in_array, array_sum, spread) #587 remain separate pre-existing follow-ups; Checker types a heterogeneous array/array merge as mixed, rejecting valid array uses (by-ref, in_array, array_sum, spread) #587 still represents the checker-side array typing gap and does not invalidate the EIR/layout fix in this PR.

Local validation on the refreshed branch:

• cargo build — passed
• 20 focused codegen/ownership regression tests — 20 passed, including both arm orders, associative arrays, COW preservation, heap-debug balance, sentinel passthrough, ternary/short-ternary, and nullable-array ??
• assembly-comment alignment — passed
• git diff --check origin/main...HEAD — clean

GitHub now sees head df2608fe6. Fresh CI is currently queued/in progress on that exact SHA; once the required matrix is green, I see no remaining blocker to merge.