Fix PEP 695 ParamSpec crashes

[JelleZijlstra]

Summary

• handle P.args and P.kwargs when a PEP 695 ParamSpec is represented internally as an input signature
• normalize flat ParamSpec specializations before constructor type-parameter substitution
• exclude runtime __type_params__ metadata from protocol requirements
• temporarily allowlist the non-crashing conformance changes introduced by parameter specification/type variable tuple variance python/typing#2215

Root cause

PEP 695 ParamSpecs use pycroscope's canonical InputSigValue representation directly, while several older paths expected runtime partial-call or ordinary gradual values. Attribute lookup and generic subscripting consequently sent these non-gradual values through replace_fallback() or gradual assignability. Constructor specialization also treated flat ParamSpec arguments as scalar types instead of single-parameter callable signatures.

The protocol mismatch was separate: runtime PEP 695 classes expose __type_params__, and pycroscope was accidentally including that metadata in structural protocol members.

The full conformance suite was run against the exact head of python/typing#2215. It now reports no internal errors and matches the updated known-failure list.

The floating taxonomy check exposed additional non-crashing findings in newly pushed taxonomy code. Those are addressed by taxonomy#83, whose pycroscope workflow passes; the currently red third-party check on this PR predates that follow-up.