fix(detector): detect nonlocal value replay

[prasannakotyal]

KernelGuard-Red-Submission: 200

Adds NONLOCAL_VALUE_REPLAY for factory-built entrypoints that replay a saved output through a nonlocal closure slot. The detector requires:

• custom_kernel assigned from a local factory call
• the factory returns an inner function
• the inner function declares a nonlocal slot initialized to None in the factory
• an input-independent guard returns that slot without compute calls
• the same nonlocal slot is assigned from input-derived data elsewhere in the inner function

Local verification:

• red_87_nonlocal_value_replay.py -> hacked, NONLOCAL_VALUE_REPLAY
• red_85_lambda_default_replay.py -> valid
• red_88_bound_method_default_replay.py -> valid
• red_89_callable_default_replay.py -> valid
• clean fixtures -> valid
• python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 102
• Blue submission: 74
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25244198901

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.