fix(detector): detect property setter replay

[prasannakotyal]

Summary

Targets KG red #188, where custom_kernel stores the first input-derived output through a property setter, then returns that same property from an input-independent fast path.

This adds a narrow PROPERTY_SETTER_REPLAY detector. It requires:

• a local class with a @property and matching @<property>.setter
• a module-level instance of that class
• an entrypoint assignment to that property from an input-derived call
• an input-independent guard over the same property
• a call-free replay body returning the same property

Property-backed lists and property-returned callable entrypoints stay out of scope.

KernelGuard-Red-Submission: 188

Local verification

• red_74_property_setter_replay -> PROPERTY_SETTER_REPLAY, should_filter=True
• red_34_property_dict_replay -> PROPERTY_SETTER_REPLAY, should_filter=True
• red_173_property_class_list_replay stayed valid
• red_485_property_callable_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 94
• Blue submission: 67
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25243932741

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.