fix(detector): detect class dunder dict replay

[prasannakotyal]

Summary

Targets KG red #193, where custom_kernel creates a local alias from Class.__dict__[key], writes the first input-derived result through that alias, then returns a subscript of the same alias from an input-independent fast path.

This adds a narrow CLASS_DUNDER_DICT_REPLAY detector. It requires:

• a local class definition
• an entrypoint local alias assigned from Class.__dict__[key]
• an input-derived assignment into a subscript of that alias
• an input-independent guard reading a subscript of the same alias
• a call-free replay body returning a subscript of that alias

Top-level Class.__dict__ aliases, class setdefault, and object __dict__ replay stay out of scope.

KernelGuard-Red-Submission: 193

Local verification

• red_80_class_dunder_dict_replay -> CLASS_DUNDER_DICT_REPLAY, should_filter=True
• red_75_class_dict_list_replay stayed valid
• red_64_class_dict_setdefault_replay stayed valid
• red_79_dunder_dict_setdefault_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 98
• Blue submission: 70
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25244030922

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.