[ty] Specialize instance members once (#29043)

## Summary

We apply a generic class's specialization once when looking up an
instance attribute. MRO lookup already specializes each member in its
defining class, but the outer lookup applied the specialization again.
When type arguments refer to the class's own parameters, that could turn
`list[T]` into `list[list[T]]` or undo a swap of `T` and `U`.

Remove the redundant specialization and cover nested and swapped type
arguments with both legacy and PEP 695 syntax.

Author: charliermarsh

crates/ty_python_semantic/resources/mdtest/generics/legacy/classes.md

@@ -2448,6 +2448,30 @@ class WithOverloadedMethod(Generic[T]):
 reveal_type(WithOverloadedMethod[int].method)
 ```
 
+## Instance attributes with substituted type variables
+
+Instance attributes are specialized once, even when the type arguments refer to the class's own type
+parameters.
+
+```py
+from typing import Generic, TypeVar
+
+T = TypeVar("T")
+U = TypeVar("U")
+
+class Pair(Generic[T, U]):
+    def __init__(self, first: T, second: U):
+        self.first: T = first
+        self.second: U = second
+
+    def swapped(self, other: "Pair[U, T]"):
+        reveal_type(other.first)  # revealed: U@Pair
+        reveal_type(other.second)  # revealed: T@Pair
+
+    def nested(self, other: "Pair[list[T], U]"):
+        reveal_type(other.first)  # revealed: list[T@Pair]
+```
+
 ## Materialized `TypeIs` return types
 
 A generic `TypeIs` in the return type of a class method is materialized along with the outer class:

crates/ty_python_semantic/resources/mdtest/generics/pep695/classes.md

@@ -1733,6 +1733,25 @@ class WithOverloadedMethod[T]:
 reveal_type(WithOverloadedMethod[int].method)
 ```
 
+## Instance attributes with substituted type variables
+
+Instance attributes are specialized once, even when the type arguments refer to the class's own type
+parameters.
+
+```py
+class Pair[T, U]:
+    def __init__(self, first: T, second: U):
+        self.first: T = first
+        self.second: U = second
+
+    def swapped(self, other: "Pair[U, T]"):
+        reveal_type(other.first)  # revealed: U@Pair
+        reveal_type(other.second)  # revealed: T@Pair
+
+    def nested(self, other: "Pair[list[T], U]"):
+        reveal_type(other.first)  # revealed: list[T@Pair]
+```
+
 ## Materialized `TypeIs` return types
 
 A generic `TypeIs` in the return type of a class method is materialized along with the outer class:

crates/ty_python_semantic/src/types/class.rs

@@ -2274,11 +2274,11 @@ impl<'db> ClassType<'db> {
                     return Place::Undefined.into();
                 }
 
-                class_literal
-                    .instance_member(db, env, specialization, name)
-                    .map_type(|ty| {
-                        ty.apply_optional_owner_specialization_to_member(db, specialization)
-                    })
+                // MRO lookup already specializes each member in the class that defines it.
+                // Applying the receiver's specialization again would also substitute type
+                // variables inside the replacement types. For example, applying `T -> list[T]`
+                // twice changes an attribute's type from `list[T]` to `list[list[T]]`.
+                class_literal.instance_member(db, env, specialization, name)
             }
         }
     }