Method-bound type-parameter can "leak" through a `Protocol`

I encountered this while working on https://github.com/python/typeshed/pull/14786:

from typing import Any, Protocol, final

@final
class Box[T]:
    _value: T

    def __init__(self, value: T, /) -> None:
        self._value = value

    def __replace__[VT](self, value: VT) -> Box[VT]:
        return Box(value)

class CanReplace[RT](Protocol):
    def __replace__(self, /, *args: Any, **kwargs: Any) -> RT: ...

def replace[RT](b: CanReplace[RT], /, **kwargs: Any) -> RT:
    return b.__replace__(**kwargs)

reveal_type(replace(Box(42), value="spam"))  # Box[VT@__replace__]

Change Box.__replace__ to (self, *, value: VT) and it (correctly) reveals Box[Any].

Start by reproducing the reported snippet and comparing the revealed type for the generic and keyword-only versions of Box.replace. Trace the type-checker path for method-scoped type parameters passed through Protocol return types, then add a regression test that verifies the method-bound parameter does not leak and the revealed type is correct.