Panic in PYI019 autofix

[AlexWaygood]

Description

Running ruff check --select=PYI019 --preview foo.pyi triggers a panic if foo.pyi has this contents:

class F:
    @classmethod
    def m[S](cls: type[S], /) -> S[int]: ...

The panic occurs at this line here:

ruff/crates/ruff_linter/src/rules/flake8_pyi/rules/custom_type_var_return_type.rs

Lines 295 to 297 in 59be5f5

	// The return annotation is guaranteed to be a name,
	// as verified by `uses_custom_var()`.
	let typevar_name = returns.as_name_expr().unwrap().id();

And the reason is that, contrary to what the comment says, uses_custom_typevar does not guarantee that the return Expr will be an ExprName, due to the map_subscript call here:

ruff/crates/ruff_linter/src/rules/flake8_pyi/rules/custom_type_var_return_type.rs

Lines 187 to 189 in 59be5f5

	let Expr::Name(return_annotation) = map_subscript(self.returns) else {
	return false;
	};

(The map_subscript call also looks buggy, FWIW.)

We should switch to a more type-safe code pattern here. Note that although the panic occurs in autofix logic, the panic occurs even if you run Ruff without --fix, since we create fixes for diagnostics even if --fix is not specified.

[AlexWaygood]

This also triggers a panic at the same location in the Rust code:

class F:
    def m[S](self: S) -> S[int]: ...

Because there's another map_subscript call here, which is also incorrect:

ruff/crates/ruff_linter/src/rules/flake8_pyi/rules/custom_type_var_return_type.rs

Lines 217 to 222 in 59be5f5

	let Expr::Name(ast::ExprName {
	id: return_type, ..
	}) = map_subscript(self.returns)
	else {
	return false;
	};