`InstanceType` and constructor return type inference doesn’t work for built‑in subtypes of `ErrorConstructor`

### 🔎 Search Terms

- "ErrorConstructor"
- "InstanceType Error"
- "InstanceType ErrorConstructor"

### 🕗 Version & Regression Information

- This is the behaviour in every version I tried, and I reviewed the FAQ for entries about this.
- I was unable to test this on prior versions because `dtslint` only tests back to **TypeScript 5.0**, and the bug workbench failed to download versions older than **TypeScript 4.0**.

### ⏯ Playground Link

https://www.typescriptlang.org/dev/bug-workbench/?#code/CYUwxgNghgTiAEkoGdnwMIFdkBcD2AtgKIwx4zwgAeOIAdsGiWRQN4BQAvu+zgJ4AHBADkiARngBeeAEk6uKHTAgAKoJAAeIgDcoEZuXR55OGJjD4YAPgDc7APT34z+AD0A-D35D4ogExSsiaKympCGgBKigDmIAYwRiZmFuS2Dk4uHl7qvkQAzIFyCkqq6pEgAGYgcCXxibjJlmmOLm6evDmiACyFwSVhmgDKfHQ4UFR1xg3mTXYtme3eIkQArL3FoWUDk0kzqXMZzlkdPqIAbOtj-WUAqhEyO9Mp1getx0sYRJchpeFLeBUMNh8MRSPt0m9PEA

### 💻 Code

```ts repro
declare class CustomError extends Error {
}

type NE1 = InstanceType;
// ^?

type NE2 = InstanceType;
// ^?

type NE3 = InstanceType;
// ^?

type NE4 = InstanceType;
// ^?

type NE5 = InstanceType;
// ^?

type NE6 = InstanceType;
// ^?

type CE = InstanceType;
// ^?
```

[Workbench Repro](https://www.typescriptlang.org/dev/bug-workbench/?#code/CYUwxgNghgTiAEkoGdnwMIFdkBcD2AtgKIwx4zwgAeOIAdsGiWRQN4BQAvu+zgJ4AHBADkiARngBeeAEk6uKHTAgAKoJAAeIgDcoEZuXR55OGJjD4YAPgDc7APT34z+AD0A-D35D4ogExSsiaKympCGgBKigDmIAYwRiZmFuS2Dk4uHl7qvkQAzIFyCkqq6pEgAGYgcCXxibjJlmmOLm6evDmiACyFwSVhmgDKfHQ4UFR1xg3mTXYtme3eIkQArL3FoWUDk0kzqXMZzlkdPqIAbOtj-WUAqhEyO9Mp1getx0sYRJchpeFLeBUMNh8MRSPt0m9PEA)

### 🙁 Actual behavior

Type query results:
```ts
type NE1 = Error
type NE2 = Error
type NE3 = Error
type NE4 = Error
type NE5 = Error
type NE6 = Error
type CE = CustomError
```

### 🙂 Expected behavior

Type query results:
```ts
type NE1 = EvalError
type NE2 = RangeError
type NE3 = ReferenceError
type NE4 = SyntaxError
type NE5 = TypeError
type NE6 = URIError
type CE = CustomError
```

### Additional information about the issue

Same happens with:
```ts repro
declare function newError(ctor: new (msg?: string) => E): E;
declare class CustomError extends Error {
}

let ne1 = newError(EvalError);
// ^?

let ne2 = newError(RangeError);
// ^?

let ne3 = newError(ReferenceError);
// ^?

let ne4 = newError(SyntaxError);
// ^?

let ne5 = newError(TypeError);
// ^?

let ne6 = newError(URIError);
// ^?

let ce = newError(CustomError);
// ^?
```

[Workbench Repro](https://www.typescriptlang.org/dev/bug-workbench/?#code/CYUwxgNghgTiAEAzArgOzAFwJYHtX1RAHcBRGGHGAHhPhAA8MRVgBneMimAPgApNKALgLF4vALasA5gH5hrDDCyopASngBebh1XCSAbgBQoSLASnW7AMLIFOcZ0p1GzNh3JOA3oYC+hwxAgGCIAjJoipB4wvCQAblAQjjCqRgD0qfCZAHoy-oHBhABM4YSRXLwASlAqIEkphumZ8Dl5QSIAzCXESZUgiCBw6LVR9Y3ZuQFthAAsXWWUvADKAJ6oGFD0dWkZ460FIACscz0AKssADsNcozvNE-kiAGzHUbwAqhUAklsNty2TwTACA0ER6NjsDhG2yaLSAA)

### Related issues
- https://github.com/DefinitelyTyped/DefinitelyTyped/pull/64628#pullrequestreview-1697561855

Start with the linked Playground repro and inspect how the built-in ErrorConstructor types interact with InstanceType and the generic newError declaration. Compare the inferred types with the expected EvalError, RangeError, ReferenceError, SyntaxError, TypeError, URIError, and CustomError results; done means the type queries and constructor calls preserve each specific subtype.

Written by the indexing model from the issue text.