Fix #653/#654: variable reassignment flow narrowing + widen all enclosing guards on escape

[nickna]

Fixes #653 and #654 — two related gaps in the type checker's control-flow narrowing of variables across assignments.

#653 — reassignment now narrows to the RHS type (was over-strict)

SharpTS narrowed a property slot to the RHS type after a write (o.x = "s" → o.x.length ok, #48) but did not do the equivalent for a variable, so it rejected code tsc accepts:

function f(x: string | null): number {
  x = "hi";
  return x.length;   // tsc: ok (x is string). Was: SharpTS error "possibly null".
}

CheckAssign previously restored the declared type after every variable write. It now restores the post-write flow-narrowed type — the declared union filtered to the members the RHS can be (NarrowToDeclaredSlot, the same primitive #48 uses for properties). The narrowed binding lives in the current lexical scope and is discarded at its block's join, so it can't leak a too-narrow type past a conditional.

Two guards keep it sound and non-regressive:

• Only tracked (function-local/parameter) variables narrow. Module/top-level variables aren't recorded in the declared-type stack, so narrowing their env binding would corrupt the declared type a later assignment checks against. Filed as Module-level variables aren't tracked in the declared-type stack (guard+reassign false positive; #653 doesn't apply at top level) #743.
• A purely-nullish narrowed slot (null/undefined) is not installed; the variable keeps its declared union. Property access on a bare null/undefined isn't flagged yet (only on a union — CheckGetOnUnion), so narrowing x = undefined to undefined would silently drop the "possibly undefined" error a later x.length must still raise. Filed as Property access on a bare null/undefined type is not flagged (only on a union) #742.

#654 — escaping reassignment now widens every enclosing guard (was a soundness hole)

function f(x: string | undefined): void {
  if (x !== undefined) {        // outer: x -> string
    if (x !== "foo") { x = undefined; }
    x.length;   // tsc: error (x is string | undefined). Was: SharpTS accepted.
  }
}

if-guard variable narrowing is applied by redefining the variable in a child TypeEnvironment. WidenEnclosingNarrowing (the #570 fix) widened only the nearest enclosing rebinding on an escaping reassignment, so with two guards on the same variable the outer guard's narrowing stayed stale. It now walks outward and widens every enclosing scope that narrows the variable, stopping at the declaration (binding == declared type) so it never crosses into an outer same-named shadowing variable.

Tests

• New VariableAssignmentFlowNarrowingTests — Variable reassignment doesn't narrow to the RHS type (over-strict; tsc accepts) #653 companion to the Type checker: narrowing doesn't flow across assignments #48 property tests: basic reassign, guard-recovery path, literal-union member preservation, compatible-in-guard, cross-member reassign checks against declared, nullish soundness, RHS-spans-union no-op, and a conditional-escape soundness guard.
• Three new cases in NestedReassignmentNarrowingTests for #570 follow-up: nested guards on the SAME variable can leave a stale outer narrowing #654: verbatim repro, three-level nesting, and a shadowing non-regression guard.

Verification

• Full unit suite: 12993 passed, 0 failed.
• TypeScript conformance subset (assignmentCompatibility, conditional): 31 passed, 0 failed — no baseline diff.
• Test262 not run: change is type-checker-only (no interpreter/compiler edits), and Test262 runs .js with type-checking off, so its baseline can't move.
• Verified the now-accepted Variable reassignment doesn't narrow to the RHS type (over-strict; tsc accepts) #653 cases run correctly in both interpreted and compiled modes.

Follow-ups filed

• Property access on a bare null/undefined type is not flagged (only on a union) #742 — flag property access on a bare null/undefined type (lets the IsPurelyNullish guard be removed for full property parity).
• Module-level variables aren't tracked in the declared-type stack (guard+reassign false positive; #653 doesn't apply at top level) #743 — track module-level declared types (fixes a pre-existing module-level guard+reassign false positive and extends Variable reassignment doesn't narrow to the RHS type (over-strict; tsc accepts) #653 to top-level variables).