Introduce ExpressionResultFactory and store ExpressionResults instead of before-Scopes

[ondrejmirtes]

First extraction step from the resolve-type-rewrite-2 branch: behavior-neutral ExpressionResult plumbing that the eventual resolveType/specifyTypes-to-callback switch builds on.

• ExpressionResultFactory becomes the single construction point for ExpressionResult (same constructor signature as today; handlers get it injected).
• ExpressionResult carries its beforeScope and Expr.
• The fiber bridge contract changes from "resume with the stored before-scope" to "resume with an ExpressionResult" (BeforeScopeForExprRequest → ExpressionResultRequest); FiberScope reads type answers off the result.
• ExpressionResultStorage keeps storing plain before-scopes — that is all the bridge needs, since every consumer resolves types on demand from the before-scope. Results are wrapped on demand at resume: from the stored before-scope for walk-processed expressions, and from the asker's own scope for synthetic nodes never processed in the walk. This keeps the storage from pinning throw points, impure points, scope callbacks and after-scopes (+42% RSS on the impure-call-columns bench in an earlier revision), and avoids re-processing synthetic subtrees (2.6–2.9× user CPU on the bug-11283 / nullsafe-chain-walk benches in an earlier revision). The turbo twin is untouched.
• Gaps in expr processing are filled (dim-fetch chains in offset assignments, pipe first-class-callable nodes) so node callbacks asking about them resume from the walk.

Validation performed locally: make phpstan clean; full make tests green with and without the turbo extension loaded (17683 tests each); turbo smoke + method/signature parity pass (extension identical to 2.2.x); bench fixtures bug-11283 / nullsafe-chain-walk / impure-call-columns at or near 2.2.x baseline; make phpstan aggregate within ~2% user CPU of 2.2.x.

🤖 Generated with Claude Code

https://claude.ai/code/session_019wqGgaD7iqL44t1KgpJS7b