Extend subtype matching to IntegerRangeType guards and restore bar() test

The guard type check was too narrow with just `instanceof UnionType` —
it missed IntegerRangeType guards like `int<1, max>` used for count-based
array narrowing via intermediate variables. Extending to also allow
IntegerRangeType fixes the bar() case in bug-4090 where `$count = count($a)`
followed by `$count === 1` should narrow the array to non-empty.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: phpstan-bot

src/Analyser/MutatingScope.php

@@ -3228,17 +3228,16 @@ public function filterBySpecifiedTypes(SpecifiedTypes $specifiedTypes): self
 						}
 						$guardType = $conditionalTypeHolder->getType();
 						// Allow subtype matching: when the specified type is a strict subtype
-						// of the guard, fire the conditional. Restricted to UnionType guards
-						// because unions represent explicit disjunctions of alternatives —
-						// narrowing to one alternative validly satisfies the guard condition.
-						// Non-union types (IntersectionType, BooleanType, etc.) can have
-						// coincidental subtype relationships that cause incorrect type
-						// narrowing when the conditional result is applied to the scope.
+						// of the guard, fire the conditional. Restricted to UnionType and
+						// IntegerRangeType guards — these represent explicit sets or ranges
+						// of values where narrowing to a member validly satisfies the guard.
+						// IntersectionType, MixedType, and other types can have coincidental
+						// subtype relationships that cause incorrect type narrowing.
 						if (
 							$conditionalExpression->getTypeHolder()->getCertainty()->yes()
 							&& $specifiedHolder->getCertainty()->yes()
 							&& $conditionalTypeHolder->getCertainty()->yes()
-							&& $guardType instanceof UnionType
+							&& ($guardType instanceof UnionType || $guardType instanceof IntegerRangeType)
 							&& $guardType->isSuperTypeOf($specifiedHolder->getType())->yes()
 						) {
 							$subtypeMatch = true;

tests/PHPStan/Analyser/nsrt/bug-4090.php

@@ -17,6 +17,19 @@ function foo(array $a): void
 }
 
 
+/** @param string[] $a */
+function bar(array $a): void
+{
+	$count = count($a);
+	if ($count > 1) {
+		echo implode(',', $a);
+	} elseif ($count === 1) {
+		assertType('string', current($a));
+		echo trim(current($a));
+	}
+}
+
+
 /** @param string[] $a */
 function qux(array $a): void
 {