Crash: RangeError: Invalid string length in addSpans during instantiation of recursive template literal types

### 🔎 Search Terms

RangeError: Invalid string length

addSpans crash

getTemplateLiteralType recursion

Template literal exponential growth

### 🕗 Version & Regression Information

Crashes in: 5.7.3, 5.8.3, 5.9.3, Nightly.

### ⏯ Playground Link

https://www.typescriptlang.org/zh/play/?target=7&ts=6.0.0-dev.20260319#code/C4TwDgpgBAIhDGAeAclCAPYEB2ATAzlNgK4C2ARhAE4B8UAvFAFBStSoZZ6ECsUA-FAAsUAFzs0mHAWECoAZjETO0wosEAmJSzYcp3KFsEBDbCG1tl+mQEY5ABiX2A3EyahIUAEoJiVFJJcMiQU1AA0UADKgapQ+MBUAJbYAOZ0jDqsekGEjoLR4j7wfohwSMg0EQAGACQA3pEAvgD69U1VNK7u4NAAouhgADYA9rjQjHWZUADaAApQyd6+-jwRAETGa3TGhLV1sy0A1hAgVQC64qYgro3OQA

### 💻 Code

```ts
type Dec =
N extends 5 ? 4 : N extends 4 ? 3 : N extends 3 ? 2 :
N extends 2 ? any :
N extends 1 ? 0 : 0;

type Recur =
N extends 0 ? S : Recur, `${S}_${S}`>;

type Explode = {
[P in Recur<5, "a"> as `${P}_key`]: any;
};
```

### 🙁 Actual behavior

```
node built/local/tsc.js -noEmit specializedSignatureIsNotSubtypeOfNonSpecializedSignature_filled_1_unvalidated_mutated_batch12.ts
D:\github\TypeScript\built\local\_tsc.js:123721
throw e;
^

RangeError: Invalid string length
at addSpans (D:\github\TypeScript\built\local\_tsc.js:62120:19)
at getTemplateLiteralType (D:\github\TypeScript\built\local\_tsc.js:62095:10)
at instantiateTypeWorker (D:\github\TypeScript\built\local\_tsc.js:63780:14)
at instantiateTypeWithAlias (D:\github\TypeScript\built\local\_tsc.js:63736:20)
at instantiateType (D:\github\TypeScript\built\local\_tsc.js:63703:29)
at getMappedType (D:\github\TypeScript\built\local\_tsc.js:63383:67)
at D:\github\TypeScript\built\local\_tsc.js:62756:73
at map (D:\github\TypeScript\built\local\_tsc.js:196:19)
at canTailRecurse (D:\github\TypeScript\built\local\_tsc.js:62756:33)
at getConditionalType (D:\github\TypeScript\built\local\_tsc.js:62723:17)

Node.js v22.19.0
```

### 🙂 Expected behavior

The compiler should not crash.

### Additional information about the issue

_No response_

Reproduce the crash with the provided recursive template-literal example or the specializedSignatureIsNotSubtypeOfNonSpecializedSignature_filled_1_unvalidated_mutated_batch12.ts command. Start from addSpans and getTemplateLiteralType in built/local/tsc.js, following the stack through instantiateTypeWorker. Done means the compiler reports or handles the input without throwing RangeError: Invalid string length.

Written by the indexing model from the issue text.