fix(detector): detect class call pointer replay

[prasannakotyal]

KernelGuard-Red-Submission: 43

Adds a narrow pointer replay pass for a class named custom_kernel whose __call__ method replays from tuple/list state.

The detector requires:

• class custom_kernel with a __call__ method
• a fast-path body with no real compute calls
• a data_ptr() equality guard between a live input parameter and saved tuple/list state
• return from the same saved state root
• later assignment of that state root to a tuple/list containing input-derived values

Local validation:

• UV_CACHE_DIR=/tmp/uvcache uv run python -m py_compile competition_state/kernelguard_mirror/kernelguard.py
• UV_CACHE_DIR=/tmp/uvcache uv run python kernelguard_bypasses/eval_blue_patch.py competition_state/kernelguard_mirror/kernelguard.py
• target artifact /tmp/kg_external_reds/0043_SarahLacard_red-class-call-replay-2026-05-01.py is filtered as POINTER_REPLAY

Target red artifact: SarahLacard red 43, class __call__ entrypoint replay.

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 168
• Blue submission: 140
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25257309205

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.