fix(detector): catch LAST_CALL_REPLAY via captured-state subscript/attribute

[SinatrasC]

Summary

Targets red submission #9 (DICT_KEYED_IDENTITY_REPLAY) — a real false negative on production KG: the existing detector keys off module-level Name storage with a stateful-looking name or a None initializer, and misses the semantically identical exploit when the saved slot lives one level removed (dict key on a captured object, or attribute on a captured instance).

state = {"last": None, "out": None}
def custom_kernel(data):
    if state["last"] is data:
        return state["out"]
    state["last"] = data
    state["out"] = data.clone()
    return state["out"]

KG classified this valid (no patterns matched) prior to this patch.

Approach

Add a quaternary pass to detect_last_call_replay:

1. Collect captured (non-parameter) roots that are written via Subscript or Attribute targets inside the entrypoint.
2. Walk every If whose body has no real compute. Trigger when its test contains an is comparison whose two sides pair up as
   • captured slot (Subscript/Attribute on a captured root) ↔ parameter ref.
3. Confirm the if-body returns a value rooted on a captured (non-parameter) name — i.e. the saved-output slot.

This catches the dict-key shape and the attribute shape without relying on the stateful-name heuristic. False-positive guards: the captured root must actually be subscripted/attribute-stored inside the entrypoint, and the if-body must be call-free.

KernelGuard-Red-Submission: 9

Test plan

• dict_subscript_replay (red E2E auto-trigger smoke test (workflow_run) #9) → flagged LAST_CALL_REPLAY, classification=hacked, should_filter=True
• getattr_identity_replay (instance attribute variant) → flagged LAST_CALL_REPLAY
• Classic last_call_replay (existing test) → still flagged
• workspace_helper, plain Triton kernel, dtype is-compare against config dict → all stay valid

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 21
• Blue submission: 11
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25190978784

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.