fix(detector): detect partial namespace replay

[prasannakotyal]

KernelGuard-Red-Submission: 216

Adds PARTIAL_NAMESPACE_REPLAY for custom_kernel assigned from partial(_run, SimpleNamespace(...)) where the bound namespace holds replay state. The detector requires:

• custom_kernel assigned from functools.partial/partial
• the bound first argument is SimpleNamespace with a None-valued field
• the helper mutates that namespace field from input-derived data
• an input-independent guard over the same field
• a no-compute fast path returning the same field

Local verification:

• red_104_partial_namespace_replay.py -> hacked, PARTIAL_NAMESPACE_REPLAY
• red_59_partial_storage_replay.py -> valid
• red_35_partial_bound_method_replay.py -> valid
• clean partial fixtures -> valid
• clean fixtures -> valid
• python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 111
• Blue submission: 83
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25244526687

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.