Fix reference type propagation for subsequent assignments

When $b = &$a creates a bidirectional reference link, assigning to either
variable should propagate the type to the other for ALL subsequent
assignments, not just the first one. The issue was that
invalidateExpression() removed the reverse-direction intertwined entries
when a variable was assigned, because the entries' sub-nodes contained
the assigned variable. This fix preserves those entries by collecting
them before invalidation and restoring reverse-direction entries after
propagation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -2647,8 +2647,12 @@ public function assignVariable(string $variableName, Type $type, Type $nativeTyp
 			$scope->nativeExpressionTypes[$exprString] = new ExpressionTypeHolder($node, $nativeType, $certainty);
 		}
 
+		// Use $this->expressionTypes (pre-invalidation) to find intertwined entries.
+		// assignExpression() calls invalidateExpression() which removes entries whose
+		// sub-nodes contain the variable being assigned. For bidirectional reference
+		// links ($b = &$a), this incorrectly removes the reverse entry.
 		$processedIntertwinedEntries = [];
-		foreach ($scope->expressionTypes as $expressionType) {
+		foreach ($this->expressionTypes as $expressionType) {
 			if (!$expressionType->getExpr() instanceof IntertwinedVariableByReferenceWithExpr) {
 				continue;
 			}