fix(detector): detect object attribute replay

[prasannakotyal]

Summary

Targets KG red #137, where custom_kernel stores the first input-derived result on a module-level SimpleNamespace attribute and later returns that attribute from an input-independent fast path.

This adds a narrow OBJECT_ATTRIBUTE_REPLAY detector. It requires:

• a module-level object created by a call
• an entrypoint mutation of one of that object's attributes from an input-derived value
• direct attribute assignment or mutating methods on an attribute container such as .append(...)
• an input-independent replay guard referencing the same object attribute
• a call-free replay body returning that same attribute, directly or by subscript

Normal local objects, input-dependent guards, and attribute use that keeps computing from current input stay out of scope.

KernelGuard-Red-Submission: 137

Local verification

• red_18_simple_namespace_replay -> OBJECT_ATTRIBUTE_REPLAY, should_filter=True
• red_52_dataclass_box_replay -> OBJECT_ATTRIBUTE_REPLAY, should_filter=True
• red_43_slots_box_replay -> OBJECT_ATTRIBUTE_REPLAY, should_filter=True
• red_205_namespace_list_replay -> OBJECT_ATTRIBUTE_REPLAY, should_filter=True
• red_492_getattr_state_replay -> OBJECT_ATTRIBUTE_REPLAY, should_filter=True
• red_493_getattribute_state_replay -> OBJECT_ATTRIBUTE_REPLAY, should_filter=True
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 66
• Blue submission: 46
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25238282080

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.