fix(detector): detect setattr box replay

[prasannakotyal]

Summary

Targets KG red #145, where custom_kernel stores the first input-derived result on a module-level object through setattr, then returns that object attribute from a call-free fast path.

This adds a narrow SETATTR_BOX_REPLAY detector. It requires:

• a module-level object created by a call
• an entrypoint hasattr or attribute-read guard for that object attribute
• a call-free replay body returning the same attribute, including getattr(obj, name)
• a setattr(obj, name, <input-derived call>) or object.__setattr__(...) mutation of that same attribute
• constant or module-level string attribute names

Normal object attribute use that computes from the current input, or attribute writes not feeding a replay return, stay out of scope.

KernelGuard-Red-Submission: 145

Local verification

• red_26_setattr_box_replay -> SETATTR_BOX_REPLAY, should_filter=True
• red_57_object_setattr_replay -> SETATTR_BOX_REPLAY, should_filter=True
• red_145_dynamic_setattr_namespace_replay -> SETATTR_BOX_REPLAY, should_filter=True
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 63
• Blue submission: 43
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25238144218

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.