fix(detector): detect bound method replay

[prasannakotyal]

Summary

Targets KG red #144, where custom_kernel is assigned to a bound instance method. The method saves the first input-derived result on self, then later returns that instance attribute from a call-free fast path.

This adds a narrow BOUND_METHOD_REPLAY detector. It requires:

• a top-level custom_kernel = K().run or custom_kernel = instance.run assignment
• a concrete class method behind that bound method
• a call-free early return of self.<attr>
• the same self.<attr> referenced by the replay guard
• an assignment to that attribute from a call involving an input parameter

Normal bound methods that compute from the current input, or methods that cache constant/config state, stay out of scope.

KernelGuard-Red-Submission: 144

Local verification

• red_24_bound_method_replay -> BOUND_METHOD_REPLAY, should_filter=True
• local red fixture sweep only triggered this new detector on red_24_bound_method_replay
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 62
• Blue submission: 42
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25238088406

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.