Covariant assignability of type guard functions is unsound

<!-- 🚨 STOP 🚨 𝗦𝗧𝗢𝗣 🚨 𝑺𝑻𝑶𝑷 🚨 Half of all issues filed here are duplicates, answered in the FAQ, or not appropriate for the bug tracker. Even if you think you've found a *bug*, please read the FAQ first, especially the Common "Bugs" That Aren't Bugs section! Please help us by doing the following steps before logging an issue: * Search: https://github.com/Microsoft/TypeScript/search?type=Issues * Read the FAQ: https://github.com/Microsoft/TypeScript/wiki/FAQ Please fill in the *entire* template below. --> <!-- Please try to reproduce the issue with `typescript@next`. It may have already been fixed. --> **TypeScript Version:** master (af8e44a) <!-- Search terms you tried before logging this (so others can find this issue more easily) --> **Search Terms:** user-defined type guard predicate assignable assignability unsound covariant invariant **Code** ```ts class A { a: string; } class B extends A { b: string; } function isB(x: {}): x is B { return x instanceof B; } const isA: (x: {}) => x is A = isB; // allowed, should be compile error const x = <A | string>new A(); if (!isA(x)) { console.log(x.slice()); // runtime error } ``` **Expected behavior:** Assignability error where marked. **Actual behavior:** Successful compilation, runtime error. **Playground Link:** [link](https://www.typescriptlang.org/play/#src=class%20A%20%7B%0D%0A%20%20%20%20a%3A%20string%3B%0D%0A%7D%0D%0Aclass%20B%20extends%20A%20%7B%20%0D%0A%20%20%20%20b%3A%20string%3B%0D%0A%7D%0D%0Afunction%20isB(x%3A%20%7B%7D)%3A%20x%20is%20B%20%7B%20%0D%0A%20%20%20%20return%20x%20instanceof%20B%3B%0D%0A%7D%0D%0Aconst%20isA%3A%20(x%3A%20%7B%7D)%20%3D%3E%20x%20is%20A%20%3D%20isB%3B%20%20%2F%2F%20allowed%2C%20should%20be%20error%0D%0A%0D%0Aconst%20x%20%3D%20%3CA%20%7C%20string%3Enew%20A()%3B%0D%0Aif%20(!isA(x))%20%7B%0D%0A%20%20%20%20console.log(x.slice())%3B%20%20%2F%2F%20runtime%20error%0D%0A%7D%0D%0A) **Related Issues:** #24865 If we want a kind of type guard function that is cov…