fix: splice() return type now correctly tracked as array

[cs01]

Summary

• arr.splice(start, count) return value can now be used as an array (.length, indexing, etc.)
• Previously, the type inference didn't recognize splice as returning the same array type as its source, causing removed.length to fail with ".length is not available on type 'number'"
• Added splice alongside slice/concat in all 4 type inference paths: expression type resolution, number array detection, string array detection, and object array detection

Test plan

• New fixture splice-return-type.ts tests both number and string array splice return values
• All tests pass (739 total)
• Self-hosting Stage 0 + Stage 1 pass

🤖 Generated with Claude Code