fix(detector): catch LAST_CALL_REPLAY via cursor-indexed reference replay

[SinatrasC]

Summary

Targets red #16 under "Direction — Reference precompute replay".
Live kernelguard==0.2.2 classifies it valid:

_REFS = []
_idx = 0

def custom_kernel(data):
    global _idx
    if _idx < len(_REFS):
        out = _REFS[_idx]
        _idx += 1
        return out
    out = data.clone()
    _REFS.append(out)
    _idx += 1
    return out

The kernel pretends to populate a list of "reference outputs" on the warmup phase, then serves them on subsequent calls by walking a cursor through that list. The replay decision is a counter test that never looks at the input.

This shape is also a static FN against the open detector PRs:

• PR fix(detector): catch LAST_CALL_REPLAY via captured-state subscript/attribute #11 (captured-state Subscript/Attribute identity) requires an is-pair → none here
• PR fix(detector): catch LAST_CALL_REPLAY via flag/counter-only gate #12 (counter/flag-only gate) requires the return root to be a mutated global Name; here it's a local assigned from a Subscript
• PR fix(detector): catch LAST_CALL_REPLAY in closure-returned inner functions #13 (closure-aliased entrypoint) requires custom_kernel = factory(); doesn't apply

Approach

A fourth pass in detect_last_call_replay, scoped tightly:

1. Compute captured names — referenced in the function body but not parameters and not top-level local Name targets. global X declarations are exempt from the local-only set.
2. Compute mutated captures — captures that the function mutates via AugAssign, Assign (only when the name is also global-declared), or attribute method call on the name (.append, .extend, .popleft, etc.).
3. Walk every If whose body has no real-compute calls and whose test references no input parameter. Require the test to name at least one mutated capture.
4. Require the if-body to return a Subscript on a mutated capture, either directly (return _REFS[_idx]) or via a local assigned from such a Subscript (out = _REFS[_idx]; ...; return out).

The "captured" + "mutated via method call" definition is what catches _REFS.append(out) — the previous flag-only pass treated only Assign / AugAssign as mutation, so a list registry filled via .append was invisible.

KernelGuard-Red-Submission: 16

Test plan

• cursor_indexed (red fix(detector): catch function-attribute replay #16) → LAST_CALL_REPLAY, should_filter=True
• cursor_indexed_direct_return (sibling shape) → flagged
• Classic last_call_replay (existing test) → still flagged
• workspace_lazy (if _buf is None: _buf = empty_like(data); return _buf + data) — stays valid (body has calls)
• shape_dispatch (if data.shape[0] > 1024: ...) — stays valid (test references input)
• config_lookup_legit (if data.dtype is _CFG['dtype']: ...) — stays valid (test references input)
• plain_dict_lookup_legit (returns from a read-only dict, no mutation) — stays valid (no mutated captures)
• plain_kernel — stays valid
• tests/test_replay_regressions.py regressions pass

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 24
• Blue submission: 14
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25215199071

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.