fix(detector): detect pointer item replay

[prasannakotyal]

KernelGuard-Red-Submission: 30

Extends detect_pointer_replay to catch saved-output replay guarded by direct tensor-object data_ptr() comparison, plus dict item iteration where cached tensor keys are compared by data_ptr() before returning the cached value.

The pass requires:

• an entrypoint if body with no real compute calls
• a return of a saved local/global value or dict item value
• a guard comparing data_ptr() on an input parameter against a saved tensor object or dict item key
• a corresponding write of the saved tensor/dict key and returned output in the entrypoint

Local validation:

• UV_CACHE_DIR=/tmp/uvcache uv run python -m py_compile competition_state/kernelguard_mirror/kernelguard.py
• UV_CACHE_DIR=/tmp/uvcache uv run python kernelguard_bypasses/eval_blue_patch.py competition_state/kernelguard_mirror/kernelguard.py
• external accepted reds now filtered locally: 30, 31, 32, 42, 101, 104

Target red artifact: SarahLacard red 30, null-sentinel pointer compare replay.

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 147
• Blue submission: 119
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25257063963

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.