fix(detector): detect helper guard state replay

[prasannakotyal]

KernelGuard-Red-Submission: 309

Adds a narrow LAST_CALL_REPLAY pass for first-call replay hidden behind an input-independent helper guard.

The detector requires:

• a nested helper in the entrypoint that returns a state-vs-None check
• an entrypoint if that calls that helper
• the guarded body assigning the same state from a live input-derived expression
• a later return of that same state

Local validation:

• UV_CACHE_DIR=/tmp/uvcache uv run python -m py_compile competition_state/kernelguard_mirror/kernelguard.py
• UV_CACHE_DIR=/tmp/uvcache uv run python kernelguard_bypasses/eval_blue_patch.py competition_state/kernelguard_mirror/kernelguard.py
• target artifact /tmp/kg_external_reds/0309_SarahLacard_red-p-141.py is filtered as LAST_CALL_REPLAY

Target red artifact: SarahLacard red 309, helper guard first-call replay variant.

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 173
• Blue submission: 145
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25257469691

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.