Defer resolveCallUserFuncCalleeReflection until needed, native param type

- Lazy-initialize innerCalleeReflection with ??= so reflection work
  only runs after the passedByReference()->createsNewVariable() check
- Use native union parameter type on resolveByRefParameterType

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/ExprHandler/FuncCallHandler.php

@@ -222,7 +222,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 				$innerParameters = $innerParametersAcceptor->getParameters();
 				$innerArgs = $innerFuncCall->getArgs();
 
-				$innerCalleeReflection = $this->resolveCallUserFuncCalleeReflection($innerFuncCall, $scope);
+				$innerCalleeReflection = null;
 
 				foreach ($innerArgs as $i => $innerArg) {
 					$argValue = $innerArg->value;
@@ -241,6 +241,7 @@ public function processExpr(NodeScopeResolver $nodeScopeResolver, Stmt $stmt, Ex
 						continue;
 					}
 
+					$innerCalleeReflection ??= $this->resolveCallUserFuncCalleeReflection($innerFuncCall, $scope);
 					$byRefType = $nodeScopeResolver->resolveByRefParameterType($innerFuncCall, $innerCalleeReflection, $innerParameter, $scope);
 					$scope = $nodeScopeResolver->processVirtualAssign(
 						$scope,