Fix phpstan/phpstan#12686: Respect closure purity in type narrowing

- Added purity check for callable variable calls ($f()) in TypeSpecifier::createForExpr()
- Previously, only named function calls (e.g. rand()) had purity checks that prevented
  type narrowing for impure functions; callable variable calls were missing this check
- New regression test in tests/PHPStan/Analyser/nsrt/bug-12686.php

Author: github-actions[bot]

src/Analyser/TypeSpecifier.php

@@ -2231,6 +2231,30 @@ private function createForExpr(
 			}
 		}
 
+		if (
+			$expr instanceof FuncCall
+			&& !$expr->name instanceof Name
+		) {
+			$nameType = $scope->getType($expr->name);
+			if ($nameType->isCallable()->yes()) {
+				$isPure = null;
+				foreach ($nameType->getCallableParametersAcceptors($scope) as $variant) {
+					$variantIsPure = $variant->isPure();
+					$isPure = $isPure === null ? $variantIsPure : $isPure->and($variantIsPure);
+				}
+
+				if ($isPure !== null) {
+					if ($isPure->no()) {
+						return new SpecifiedTypes([], []);
+					}
+
+					if (!$this->rememberPossiblyImpureFunctionValues && !$isPure->yes()) {
+						return new SpecifiedTypes([], []);
+					}
+				}
+			}
+		}
+
 		if (
 			$expr instanceof MethodCall
 			&& $expr->name instanceof Node\Identifier

tests/PHPStan/Analyser/nsrt/bug-12686.php

@@ -0,0 +1,23 @@
+<?php declare(strict_types = 1);
+
+namespace Bug12686;
+
+use function PHPStan\Testing\assertType;
+
+/** @phpstan-impure */
+$f = function (): bool {
+	return (bool) rand(0,1);
+};
+
+if ($f()) {
+	assertType('bool', $f());
+}
+
+// Pure closure should still have narrowing
+$h = function (): bool {
+	return true;
+};
+
+if ($h()) {
+	assertType('true', $h());
+}