fix(detector): detect dict view replay

[prasannakotyal]

Summary

Targets KG red #149, where custom_kernel mutates a captured dict with an input-derived value, then replays the first stored value through next(iter(_s.values())) from an input-independent fast path.

This adds a narrow DICT_VIEW_REPLAY detector. It requires:

• a module-level dict state object
• an entrypoint mutation of that dict from an input-derived value, through subscript assignment, .update, .setdefault, or .__setitem__
• an input-independent replay guard
• a replay body containing only dict-view accessor calls such as next, iter, .values, and .items
• a return sourced from the same mutated dict view, directly or through a local view alias

Normal dict lookups, copied dicts, and replay bodies with other calls stay out of scope.

KernelGuard-Red-Submission: 149

Local verification

• red_29_dict_update_replay -> DICT_VIEW_REPLAY, should_filter=True
• red_63_dict_values_replay -> DICT_VIEW_REPLAY, should_filter=True
• red_298_dict_values_view_replay -> DICT_VIEW_REPLAY, should_filter=True
• red_299_dict_items_view_replay -> DICT_VIEW_REPLAY, should_filter=True
• red_215_dict_get_replay stayed valid
• red_223_dict_copy_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 65
• Blue submission: 45
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25238245003

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.