fix(detector): catch LAST_CALL_REPLAY via flag/counter-only gate

[SinatrasC]

Summary

Targets red #11 (COUNTER_SKIP_REPLAY) — submitted via the new flat
POST /v1/red-submissions route on production KG (kguard.sinatras.dev)
and classified valid by the deployed kernelguard==0.2.2.

_OUT = None
_N = 0

def custom_kernel(data):
    global _OUT, _N
    _N += 1
    if _N > 1 and _OUT is not None:
        return _OUT
    _OUT = data.clone()
    return _OUT

Distinct from the identity-replay family (LAST_CALL_REPLAY classic, dict-keyed,
attribute-keyed): there is no is-comparison between the input and a saved
slot. The gate is purely a module-level counter/flag, and the early-return
path drops the input on the floor — that's the smoking gun.

Approach

Add a fourth pass to detect_last_call_replay. It triggers only when ALL
four guards hold:

1. The entrypoint declares one or more global names.
2. At least one of those globals is mutated inside the entrypoint
   (counter increment, flag toggle, output assignment).
3. An If whose test references those mutated globals but does not
   reference any parameter name, and whose body has no real compute calls.
4. The if-body returns a value rooted on a mutated global (the saved-output slot).

This is tight enough to avoid false-positives on:

• workspace allocators (if _buf is None: _buf = torch.empty_like(data)) — body has calls
• shape-dispatch helpers (if data.shape[0] > 1024: ...) — test references parameter
• compile-cache wrappers (if _compiled is None: _compiled = torch.compile(...)) — body has calls

KernelGuard-Red-Submission: 11

Test plan

• counter_skip (red fix(detector): catch LAST_CALL_REPLAY via captured-state subscript/attribute #11) → flagged LAST_CALL_REPLAY, should_filter=True
• first_call_init_lock (sibling pattern) → flagged
• Existing classic LAST_CALL_REPLAY → still flagged
• workspace_alloc_lazy, plain_kernel, shape_dispatch_legit, global_compile_cache_legit → all stay valid
• tests/test_replay_regressions.py regression tests pass (excluding the pre-existing test_configure_runtime_records_selected_profile failure unrelated to detector logic)

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 22
• Blue submission: 12
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25193723709

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.