[ty] Preserve pure negation types in descriptor protocol (#22907)
## Summary
When accessing an attribute with a pure negation type (an intersection
with only negative contributions, like `~AlwaysFalsy`), the descriptor
protocol would incorrectly return object instead of preserving the
negation type, because `map_with_boundness` iterates over
`positive_elements_or_object`, which falls back to `object` when there
are no positive elements.
