fix(detector): detect list subclass replay

[prasannakotyal]

Summary

Targets KG red #186, where custom_kernel stores the first input-derived output in a module-level instance of a list subclass, then returns that stored subscript from an input-independent fast path.

This adds a narrow LIST_SUBCLASS_REPLAY detector. It requires:

• a local class explicitly inheriting from list
• a module-level instance of that class
• an entrypoint mutating that instance through .append, .extend, or .insert with input-derived data
• an input-independent guard over the same instance
• a call-free replay body returning a subscript of that instance

Dict/deque subclasses and custom subclass methods stay out of scope.

KernelGuard-Red-Submission: 186

Local verification

• red_70_list_subclass_replay -> LIST_SUBCLASS_REPLAY, should_filter=True
• red_71_dict_subclass_replay stayed valid
• red_72_deque_subclass_replay stayed valid
• red_199_list_subclass_method_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 93
• Blue submission: 66
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25243908352

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.