ICE in `ArrayType::calldataEncodedTailSize` when a self-recursive function returns a calldata struct with an oversized array member

The compiler panics with `Array size does not fit unsigned.` in [`libsolidity/ast/Types.cpp:1801`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libsolidity/ast/Types.cpp#L1801) inside `ArrayType::calldataEncodedTailSize()` when a function recursively calls itself and returns a `calldata` struct containing a statically-sized array of dynamic arrays large enough for its tail encoding size to overflow `unsigned`.

MRE:
```solidity
contract C {
struct S { uint256[][4294967292] x; }
function foo() public returns (S[] calldata) { foo(); }
}
```

Reproduce: save as `mre.sol`, run `solc --bin mre.sol`.

Output:
```
Internal compiler error:
/solidity/libsolidity/ast/Types.cpp(1801): Throw in function virtual unsigned int solidity::frontend::ArrayType::calldataEncodedTailSize() const
Dynamic exception type: boost::wrapexcept
std::exception::what: Array size does not fit unsigned.
[solidity::util::tag_comment*] = Array size does not fit unsigned.
```

Expected behavior: same as 0013 — a type error rejecting the oversized array before codegen.

Without the recursive call, the compiler exits cleanly with no error. The self-call is needed to trigger ABI codegen for the return type's tail size. Related to 0013 (`calldataEncodedSize` at line 1789) — same root cause, different function, different type category (dynamically-encoded vs statically-encoded).

Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++

Start at libsolidity/ast/Types.cpp:1801 in ArrayType::calldataEncodedTailSize(), then reproduce with the supplied mre.sol using solc --bin. Compare the behavior with related issue 0013 and its calldataEncodedSize case. Done means the oversized array is rejected as a type error before codegen rather than producing an internal compiler error.

Written by the indexing model from the issue text.