fix(detector): catch LAST_CALL_REPLAY in closure-returned inner functions

[SinatrasC]

Summary

Targets red #14 — submitted via the new Flywheel-proxied red-submission
flow on the campaign root (no participant KG API key). Live kernelguard==0.2.2
classified the exploit valid because the is data: return saved_out logic
lives in a closure-returned inner function bound to custom_kernel only at
module load:

def _make_kernel():
    last_in = None
    last_out = None
    def k(data):
        nonlocal last_in, last_out
        if last_in is data:
            return last_out
        last_in = data
        last_out = data.clone()
        return last_out
    return k

custom_kernel = _make_kernel()

Same exploit shape as textbook LAST_CALL_REPLAY; only the storage
location (closure cells vs module globals) and the entrypoint binding
(factory return vs def custom_kernel) changed.

Approach

Walk the module top-level once at the start of detect_last_call_replay
to collect entrypoint aliases:

• custom_kernel = some_function → alias = {some_function}
• custom_kernel = factory() → factory is inspected for top-level Returns; any returned Name is added to the alias set

The main entrypoint loop now accepts either is_entrypoint_name(node.name)
or node.name in entrypoint_aliases, so the existing identity-replay
passes fire on the inner function as if it were named custom_kernel.
_looks_stateful_name already matches last_in/last_out via the
"last" substring, so no other detector logic needed changing.

KernelGuard-Red-Submission: 14

Test plan

• closure_replay (red fix(detector): catch LAST_CALL_REPLAY via cursor-indexed reference replay #14) → flagged LAST_CALL_REPLAY, should_filter=True
• Existing classic last_call_replay (module globals) → still flagged
• legit_factory_kernel (return data + 1) → stays valid
• legit_factory_with_buffer (if buf is None: buf = empty_like; return buf + data) → stays valid (workspace pattern, body has calls)
• legit_decorator_kernel (no replay logic) → stays valid
• plain_kernel → stays valid
• tests/test_replay_regressions.py regressions pass (excluding the pre-existing strict-profile config test failure unrelated to detector logic)

Decorator-wrapped replay (@_replay_cache def custom_kernel) is a
separate FN that this PR does not address — left for a follow-up.

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 23
• Blue submission: 13
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25212420460

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.