`InstanceType` and constructor return type inference doesn’t work for built‑in subtypes of `ErrorConstructor`

### 🔎 Search Terms

- "ErrorConstructor"
- "InstanceType Error"
- "InstanceType ErrorConstructor"

### 🕗 Version & Regression Information

- This is the behaviour in every version I tried, and I reviewed the FAQ for entries about this.
- I was unable to test this on prior versions because `dtslint` only tests back to **TypeScript 5.0**, and the bug workbench failed to download versions older than **TypeScript 4.0**.

### ⏯ Playground Link

https://www.typescriptlang.org/dev/bug-workbench/?#code/CYUwxgNghgTiAEkoGdnwMIFdkBcD2AtgKIwx4zwgAeOIAdsGiWRQN4BQAvu+zgJ4AHBADkiARngBeeAEk6uKHTAgAKoJAAeIgDcoEZuXR55OGJjD4YAPgDc7APT34z+AD0A-D35D4ogExSsiaKympCGgBKigDmIAYwRiZmFuS2Dk4uHl7qvkQAzIFyCkqq6pEgAGYgcCXxibjJlmmOLm6evDmiACyFwSVhmgDKfHQ4UFR1xg3mTXYtme3eIkQArL3FoWUDk0kzqXMZzlkdPqIAbOtj-WUAqhEyO9Mp1getx0sYRJchpeFLeBUMNh8MRSPt0m9PEA

### 💻 Code

```ts repro
declare class CustomError extends Error {
}

type NE1 = InstanceType;
// ^?

type NE2 = InstanceType;
// ^?

type NE3 = InstanceType;
// ^?

type NE4 = InstanceType;
// ^?

type NE5 = InstanceType;
// ^?

type NE6 = InstanceType;
// ^?

type CE = InstanceType;
// ^?
```

[Workbench Repro](https://www.typescriptlang.org/dev/bug-workbench/?#code/CYUwxgNghgTiAEkoGdnwMIFdkBcD2AtgKIwx4zwgAeOIAdsGiWRQN4BQAvu+zgJ4AHBADkiARngBeeAEk6uKHTAgAKoJAAeIgDcoEZuXR55OGJjD4YAPgDc7APT34z+AD0A-D35D4ogExSsiaKympCGgBKigDmIAYwRiZmFuS2Dk4uHl7qvkQAzIFyCkqq6pEgAGYgcCXxibjJlmmOLm6evDmiACyFwSVhmgDKfHQ4UFR1xg3mTXYtme3eIkQArL3FoWUDk0kzqXMZzlkdPqIAbOtj-WUAqhEyO9Mp1getx0sYRJchpeFLeBUMNh8MRSPt0m9PEA)

### 🙁 Actual behavior

Type query results:
```ts
type NE1 = Error
type NE2 = Error
type NE3 = Error
type NE4 = Error
type NE5 = Error
type NE6 = Error
type CE = CustomError
```

### 🙂 Expected behavior

Type query results:
```ts
type NE1 = EvalError
type NE2 = RangeError
type NE3 = ReferenceError
type NE4 = SyntaxError
type NE5 = TypeError
type NE6 = URIError
type CE = CustomError
```

### Additional information about the issue

Same happens with:
```ts repro
declare function newError(ctor: new (msg?: string) => E): E;
declare class CustomError extends Error {
}

let ne1 = newError(EvalError);
// ^?

let ne2 = newError(RangeError);
// ^?

let ne3 = newError(ReferenceError);
// ^?

let ne4 = newError(SyntaxError);
// ^?

let ne5 = newError(TypeError);
// ^?

let ne6 = newError(URIError);
// ^?

let ce = newError(CustomError);
// ^?
```

[Workbench Repro](https://www.typescriptlang.org/dev/bug-workbench/?#code/CYUwxgNghgTiAEAzArgOzAFwJYHtX1RAHcBRGGHGAHhPhAA8MRVgBneMimAPgApNKALgLF4vALasA5gH5hrDDCyopASngBebh1XCSAbgBQoSLASnW7AMLIFOcZ0p1GzNh3JOA3oYC+hwxAgGCIAjJoipB4wvCQAblAQjjCqRgD0qfCZAHoy-oHBhABM4YSRXLwASlAqIEkphumZ8Dl5QSIAzCXESZUgiCBw6LVR9Y3ZuQFthAAsXWWUvADKAJ6oGFD0dWkZ460FIACscz0AKssADsNcozvNE-kiAGzHUbwAqhUAklsNty2TwTACA0ER6NjsDhG2yaLSAA)

### Related issues
- https://github.com/DefinitelyTyped/DefinitelyTyped/pull/64628#pullrequestreview-1697561855

リンクされた Playground の再現コードから始め、組み込みの ErrorConstructor 型が InstanceType およびジェネリックな newError 宣言とどのように相互作用するかを調べます。推論された型を、EvalError、RangeError、ReferenceError、SyntaxError、TypeError、URIError、CustomError に対して期待される結果と比較します。型クエリとコンストラクター呼び出しがそれぞれの固有のサブタイプを保持していれば完了です。

索引モデルが issue の本文から書いたものです。