Fix Callable[..., ...] false negative (#3912)

[ibraheemshaikh5]

Summary

When Callable[..., ...] is annotated, the second ellipsis sits in the return slot where ... is not a valid type, but pyrefly accepted it silently and revealed (...) -> Ellipsis. The return type was flowing through expr_untype as Type::Ellipsis, which nothing rejected.

This resolves that by checking for a literal ... in the Callable return argument inside specials.rs, emitting an error, and recovering as Unknown. The change is intentionally small and scoped to that slot only, with a regression test in callable.rs.

Fixes #3912

Test Plan

Added test_callable_ellipsis_return for the Callable[..., ...] case. Ran the callable and paramspec test suites plus test.py locally all green, no conformance changes.

[meta-codesync]

@kinto0 has imported this pull request. If you are a Meta employee, you can view this in D109604289.

[jorenham]

The way this is worded (the "for Callable" bit mostly) could be interpreted to mean that ... can be used as return type in other places. But's it's not valid as a (return) type in general.

[ibraheemshaikh5]

Thank you, good catch. I just pushed a commit to tighten up the wording. TAL at what you mentioned in the issue thread now.

[jorenham]

For f() -> ... pyrefly currently uses invalid-annotation as error code, so maybe we should also use that one (InvalidAnnotation) here?

[github-actions]

According to mypy_primer, this change doesn't affect type check results on a corpus of open source code. ✅

[ibraheemshaikh5]

I extended the fix beyond the Callable return slot. Now the following cases are covered:

• list[...] / dict[int, ...] (type-argument positions) now report ... cannot be used for type parameter with invalid-annotation, replacing the ParamSpec message
• class C[T: ...], type[...], and TypeVar(bound=...) report Ellipsis is not allowed in this context (invalid-annotation).
• The Callable return type error now uses InvalidAnnotation for consistency and accuracy

For testing:
Added test_ellipsis_invalid_type_form in simple.rs covering the full list (including tuple[...]), and confirmed valid uses still pass: Callable[..., int], tuple[int, ...], ParamSpec(default=...), and ParamSpec specialization.