fix(detector): detect object dict replay

[prasannakotyal]

Summary

Targets KG red #147, where custom_kernel aliases an object instance __dict__, stores the first input-derived output through that dict alias, then returns the alias subscript from an input-independent fast path.

This adds a narrow OBJECT_DICT_REPLAY detector. It requires:

• a module-level object instance, excluding ModuleType
• an entrypoint local alias assigned from obj.__dict__ or vars(obj)
• an input-derived assignment to a subscript of that alias
• an input-independent guard over the same alias
• a call-free replay body returning a subscript of that alias

ModuleType dict replay, function vars(...) state, and normal computing paths stay out of scope.

KernelGuard-Red-Submission: 147

Local verification

• red_27_object_dict_replay -> OBJECT_DICT_REPLAY, should_filter=True
• red_56_vars_box_replay -> OBJECT_DICT_REPLAY, should_filter=True
• red_121_namespace_dict_replay -> OBJECT_DICT_REPLAY, should_filter=True
• red_144_module_dict_replay stayed valid
• red_214_vars_function_setdefault_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 89
• Blue submission: 62
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25243825259

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.