fix(optimizer): preserve typed builtin argument validation

[hafung]

Summary

• keep reflection-optimized builtin calls on their direct C++ ABI only when every supplied primitive/container argument is statically safe for that ABI
• fall back the whole call to Zend dispatch when a runtime-backed string, int, float, bool, or array value still needs PHP's parameter validation
• apply the same rule to typed custom handlers without disabling their proven static and native-object fast paths

Invariant

An optimizer must not erase the runtime zval type before an internal function has applied its parameter contract. A direct ABI call is valid only when the compiler proves that its conversion has the same accepted/rejected behavior as Zend; otherwise all arguments remain on the ordered php::call() path.

This fixes strict calls such as a mixed value passed to in_array()'s boolean parameter being coerced by generated C++ instead of raising the same TypeError as Zend.

Coverage

• fixed and variadic reflected parameters
• string, int, float, bool, and array ABI parameters
• nullable/default handling and the existing literal-null policy
• nested value-used calls, unpacking, and left-to-right evaluation order
• selected custom handlers (array_keys, array_key_exists, round, count, define, and function_exists)
• exact/static scalar paths, Decimal round(), and native Countable paths remain optimized

Verification

• PHP 8.5.10 Zend baseline: regression fixture passes
• Windows/MSVC source AOT artifact: regression fixture passes at O0 and O3
• Linux/GCC generated-code PHPUnit: 1 test, 7 assertions pass
• adjacent AOT regressions: 7/7 pass (array_keys, lookup calls, func_get_arg, Decimal round, count(Countable), and internal-interface coverage)
• stdlib AOT suite: 60/62 pass; the two remaining failures are existing expectation mismatches (PHP 8.5 bindec() deprecations and Windows path separators)

The full PHPUnit suite was also attempted, but the current Windows run has unrelated existing failures and terminates on a Linux-only profile fixture, so it is not claimed as passing. Remote CI and non-MSVC native artifacts were not run locally.