Summary

Fixes an infinite recursion / OOM crash triggered when PHPStan analyzes a ternary expression that:

1. Uses count($arr) > N on a constant array with optional keys as the condition
2. Has both branches produce falsy values (e.g., count($m) > 1 ? false : '')

The crash occurs because AssignHandler calls specifyTypesInCondition in false context on the ternary, which expands it into BooleanOr(BooleanAnd(...), ...). Processing this reaches specifyTypesForCountFuncCall with a false context. The function's falsey-branch guard passes, and it recurses with $context->negate(). But negate(false) = 0b1011, which has both truthy and falsey bits set. On re-entry, the $context->falsey() guard passes again → infinite recursion → OOM.

The fix replaces $context->negate() with explicit TypeSpecifierContext::createTrue() or createTruthy(), ensuring the recursive call always uses a clean truthy context that cannot re-enter the falsey branch.

Minimal reproducer (crashes without fix):

/** @param array{0: string, 1?: string} $m */
function test(array $m): void {
    $x = count($m) > 1 ? false : '';
}

Closes phpstan/phpstan#14605