Fix GH-17144: type inference narrowing on ZEND_FETCH_DIM_W

[iliaal]

Summary

FETCH_DIM_W stripped MAY_BE_ARRAY_EMPTY only inside a block guarded by key_type & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING). When the key operand's type widened across loop iterations (e.g. from MAY_BE_ARRAY to include scalar types), key_type went from 0 to non-zero, causing the flag to be stripped on the second pass but not the first. This violated monotonicity and triggered the narrowing assertion.

Strips MAY_BE_ARRAY_EMPTY for write opcodes (W, RW, LIST_W) regardless of key_type, since a dimension write makes the array non-empty.

Fixes #17144

[dstogov]

This solution looks completely wrong.
The following PHP code doesn't modify $a (it throws exception) and $a is still empty.

$a = [];
$a[$a] = 1;

[iliaal]

Confirmed: $a = []; $a[$a] = 1; throws before the write, so unconditional stripping was wrong. Pushed a corrected version that strips MAY_BE_ARRAY_EMPTY only when the key is guaranteed valid: either op2 is IS_UNUSED (append) or t2 has no MAY_BE_ARRAY|MAY_BE_OBJECT bits. Once t2 gains ARRAY or OBJECT, the strip stays inactive, so the result type can only gain MAY_BE_ARRAY_EMPTY across iterations, never lose it. Test now covers both the original narrowing reproducer and the invalid-key throw path.