fix(detector): detect try/except replay

[prasannakotyal]

KernelGuard-Red-Submission: 139

Detects try-fast-path replay where the try body returns captured state and the exception handler fills that same state.

The pass requires:

• try body with no real compute calls
• try-body return by subscript from captured state
• exception handler mutation of that same captured state

Local validation:

• uv run python -m py_compile kernelguard.py
• uv run python /home/nino/repos/paradigma/kernelguard_bypasses/eval_blue_patch.py /home/nino/repos/paradigma/competition_state/kernelguard_mirror/kernelguard.py

Target red fixture: red_19_try_except_list_replay.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 143
• Blue submission: 115
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25254375921

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.