fix(detector): detect mutable default identity replay

[prasannakotyal]

KernelGuard-Red-Submission: 84

Adds a narrow LAST_CALL_REPLAY pass for mutable default state shaped as [previous_input, previous_output].

The detector requires:

• a mutable default argument with at least two slots
• an input-identity fast path comparing a state slot with a live parameter
• a fast-path return from the same default state
• later writes of both the input slot and an input-derived output slot

Local validation:

• UV_CACHE_DIR=/tmp/uvcache uv run python -m py_compile competition_state/kernelguard_mirror/kernelguard.py
• UV_CACHE_DIR=/tmp/uvcache uv run python kernelguard_bypasses/eval_blue_patch.py competition_state/kernelguard_mirror/kernelguard.py
• target artifact /tmp/kg_external_reds/0084_SarahLacard_red-mdef-2026-05-01.py is filtered as LAST_CALL_REPLAY

Target red artifact: SarahLacard red 84, mutable default arg list state.

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 167
• Blue submission: 139
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25257290475

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. This PR is now superseded by the consolidated rule-family implementation in #273, which folds this detector coverage together with the related passing-eval variants.