fix(detector): detect abstract property sentinel replay

[prasannakotyal]

Summary

• add class-sentinel replay detection for input-derived results stored on None initialized class attributes
• cover abstract-property distractor classes where the replay state is a plain subclass attribute
• include companion global sentinel and bmm self-output coverage from the same visible red batch

Target

KernelGuard-Red-Submission: 796

Validation

• UV_CACHE_DIR=/tmp/uvcache uv run python -m py_compile kernelguard.py
• red 796 sample: classification=hacked, should_filter=true, pattern LAST_CALL_REPLAY
• red 792/793/794/795 samples: classification=hacked, should_filter=true
• UV_CACHE_DIR=/tmp/uvcache uv run python ../../kernelguard_bypasses/eval_blue_patch.py kernelguard.py clean fixtures remain should_filter=False

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 221
• Blue submission: 178
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/27883197298

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.