Fix virtual dispatch / type filtering for uninstantiated generic subclasses

[stakach]

Fixes #11134, #10831.

Two open bugs both trace back to the type lattice treating uninstantiated generic subclasses as outside the "virtual" view of their parent class:

• Dispatch over virtual metaclasses ignores uninstantiated generic subclasses #11134: Bar.as(Foo.class).foo segfaults. The dispatch table for Foo+.class.foo has no branch for Bar.metaclass, so it falls through the unreachable.
• is_a?(T) can break further type filtering if T is an uninstantiated generic #10831 (deeper case): x.is_a?(B) && x.is_a?(C) returns false (and the typeof collapses to NoReturn in some shapes) when class C(T) < B(T). After the first is_a?(B), x is narrowed to B — and common_descendent(B, C) then doesn't find a path back to C because it only walks one side of the generic relationship.

The same code paths likely affect #16947 (Array(Foo) containing a SubGenericFoo(String)), but I couldn't reproduce its segfault on current master in any build mode, so I'm not claiming it as a fixed issue. The codegen change here plausibly helps it, but without a deterministic reproducer there's no regression test, so I'd rather leave it open and let it be closed only when someone can confirm.

Root cause

Type#collect_subtypes in src/compiler/crystal/types.cr filters out GenericType from a virtual type's subtypes:

subtypes << type unless type.is_a?(GenericType) || type.unbound?

That's right for instance virtual dispatch — Bar(T) itself isn't instantiable — but for metaclass dispatch the uninstantiated Bar IS a callable class value. And in the intersection logic, the absence of the relationship in both directions makes chained is_a? filters collapse.

Fix

Three coordinated changes:

1. Type::VirtualType (types.cr): add subtypes_including_generic and collect_subtypes_including_generic. They yield uninstantiated GenericType subclasses only when no instantiations exist — if instantiations exist, those already carry the dispatch, and including the uninstantiated form would trip up class methods that reference the type parameter (e.g. def self.x; T.foo; end, the pattern in spec Error: can't instantiate abstract generic struct EnumType(Test) #9621). This is what kept the regression scope small.

2. VirtualMetaclassType#each_concrete_type (types.cr) and VirtualTypeLookup#lookup_matches (method_lookup.cr): use the new method when iterating subtypes for a virtual metaclass. This adds the missing branch for Bar.metaclass in Foo+.class's dispatch table and ~match function. Instance virtual dispatch is unchanged.

3. common_descendent(GenericClassType, GenericClassType) (type_intersect.cr): try common_descendent_instance_and_generic in both directions, so the relationship C(T) < B(T) flows in either order through chained is_a?.

Tests

• spec/compiler/codegen/class_spec.cr — one run-based regression for Dispatch over virtual metaclasses ignores uninstantiated generic subclasses #11134 (return value 2).
• spec/compiler/semantic/is_a_spec.cr — one run(...).to_b regression for is_a?(T) can break further type filtering if T is an uninstantiated generic #10831 deep case. (Verified to fail on the unpatched compiler and pass on the patched one.)

The simple case of #10831 (x.is_a?(B) && x.is_a?(B(Int32))) was already fixed previously and continues to pass.

[straight-shoota]

It seems like #10831 and #11134 are related, but independent bugs. We should fix them in separate PRs.

[stakach]

Splitting per @straight-shoota's review — see #16998 (virtual metaclass dispatch fix for #11134) and #16999 (symmetric common_descendent for #10831). Closing this PR; the split branches are off fresh master and contain only the changes relevant to each issue, with regression tests that have been verified to fail on master and pass with the fix.