Enforce package rules on ::class expressions for strict-isolation packages

Summary:
# Context

`Foo::class` expressions do not produce package-boundary errors: under the
`package_allow_classconst_violations` migration carve-out they are downgraded to a
classptr lint (`ClassPtrLinterOnly`) so intern/prod separation V1 can roll out
without breaking `::class` callers. For a package that opts into strict isolation
(`enable_strict_isolation = true`), a `::class` reference from a package that does
not include it should be a hard violation, not just a lint.

# Solution

In the `class_expr` mode selector (the single site that classifies class-id
references), when the reference is a `::class` (`is_classptr`) and the target
class's package has strict isolation enabled, the boundary reason is upgraded from
`ClassPtrLinterOnly` to a hard `Yes Class` error (reusing cross-package error code
4472). The strict-isolation lookup happens only on the `::class` branch, so the
common class-reference path is unaffected. Non-strict targets keep the existing
classptr lint behavior.

# Tests

New verify tests under `test/package/strict_isolation/`: a `::class` reference to a
strict-isolation class from another package is a violation; the same reference
from within its own package is allowed.

Reviewed By: madgen

Differential Revision: D112642501

fbshipit-source-id: eccd94e20cc9358c14bb8256e6d068896e869a18

Author: dlreeves

hphp/hack/src/typing/typing.ml

@@ -11965,7 +11965,17 @@ end = struct
             else if is_const then begin
               if Env.package_allow_classconst_violations env then
                 if is_classptr then
-                  `ClassPtrLinterOnly
+                  (* `Foo::class` is normally only a migration-era classptr lint,
+                     but a strict-isolation target makes it a hard package
+                     violation. *)
+                  if
+                    Typing_packages.is_strict_isolation_target
+                      env
+                      (Cls.get_package class_)
+                  then
+                    `Yes Typing_error.Primary.Package.Class
+                  else
+                    `ClassPtrLinterOnly
                 else
                   (* Non-::class constants: skip the class-level check
                      here and let class_const handle it *)

hphp/hack/test/package/strict_isolation/classptr_cross_package_forbidden.php

@@ -0,0 +1,13 @@
+//// isolated/c.php
+<?hh
+// A class in the strict-isolation package `isolated`.
+class IsolatedClassPtr {}
+
+//// intern/use.php
+<?hh
+// `intern` does not include `isolated`. A `::class` reference to its class is a
+// package violation for a strict-isolation package (normally only a classptr
+// lint under the migration carve-out).
+function use_isolated_classptr(): void {
+  $_ = IsolatedClassPtr::class;
+}

hphp/hack/test/package/strict_isolation/classptr_cross_package_forbidden.php.exp

@@ -0,0 +1,38 @@
+error: Typing[4472] Cannot access class `IsolatedClassPtr` defined in package `isolated` which may not be available [1]
+-> `IsolatedClassPtr` is defined in classptr_cross_package_forbidden.php--isolated/c.php [2]
+-> `IsolatedClassPtr` belongs to package `isolated` by this package definition [3]
+-> package `intern` is available because the current file belongs to it by this package definition [4]
+-> `intern` includes `shared` via its definition [5]
+
+classptr_cross_package_forbidden.php--intern/use.php:6:8
+ 4 | // lint under the migration carve-out).
+ 5 | function use_isolated_classptr(): void {
+ 6 |   $_ = IsolatedClassPtr::class;
+   |        ^^^^^^^^^^^^^^^^ [1]
+ 7 | }
+
+classptr_cross_package_forbidden.php--isolated/c.php:3:7
+ 1 | <?hh
+ 2 | // A class in the strict-isolation package `isolated`.
+ 3 | class IsolatedClassPtr {}
+   |       ^^^^^^^^^^^^^^^^ [2]
+
+PACKAGES.toml:14:11
+ 4 | include_paths = ["//shared/"]
+ 5 | 
+ 6 | [packages.intern]
+   |           ^^^^^^ [4]
+ 7 | include_paths = ["//intern/"]
+ 8 | includes = ["shared"]
+   |             ^^^^^^^^ [5]
+ 9 | 
+10 | # A package that opts into strict isolation. Its presence may not be dynamically
+11 | # observed (no `package` expression / `__RequirePackage`), and
+12 | # package_exclude_patterns (e.g. __tests__) do not grant a typecheck exemption
+13 | # for references into it.
+14 | [packages.isolated]
+   |           ^^^^^^^^ [3]
+15 | include_paths = ["//isolated/"]
+16 | includes = ["intern", "shared"]
+
+1 error found

hphp/hack/test/package/strict_isolation/classptr_same_package_ok.php

@@ -0,0 +1,11 @@
+//// isolated/c.php
+<?hh
+// A class in the strict-isolation package `isolated`.
+class IsolatedClassPtr2 {}
+
+//// isolated/use.php
+<?hh
+// Same package (`isolated`) may take a `::class` reference to its own class.
+function use_within_isolated(): void {
+  $_ = IsolatedClassPtr2::class;
+}

hphp/hack/test/package/strict_isolation/classptr_same_package_ok.php.exp

@@ -0,0 +1 @@
+No errors