typeintersect: fix incorrect innervar handling under circular env (#54545)
The infinite loop encountered in #54516 has been traced back to a
circular bound during `finish_unionall`.
As we insert innervar more eagerly now, the direct `jl_has_typevar`
could not find all circularity.
To address this, `has_typevar_via_flatten_env` is added to perform
thorough check.
Although there is some code duplication with `reachable_var`, it could
be improved in future refactoring.
#54516 also highlighted another free var escaping regression since
v1.10. This regression is not solely
the result of incomplete checks, it is also caused by the missing final
substitution of `vb`'s bound, which has now been corrected.
At last, this PR adds an assertion of sorting complexity, which should
facilitate the detection of similar issues by PkgEval.
close #54516