fix(detector): detect getattribute box replay

[prasannakotyal]

Summary

Targets KG red #192, where custom_kernel replays through a helper method that returns object.__getattribute__(self, "value"), while the actual stored result is written to that same instance attribute from the first input.

This adds a narrow GETATTRIBUTE_BOX_REPLAY detector. It requires:

• a local class method returning object.__getattribute__(self, <constant attr>)
• a module-level instance of that class
• an entrypoint assignment to that same instance attribute from an input-derived call
• an input-independent guard using the helper reader
• a replay body containing only that helper reader and returning it

Custom __getattr__, custom __getattribute__, and plain attribute replay stay out of scope.

KernelGuard-Red-Submission: 192

Local verification

• red_78_getattribute_box_replay -> GETATTRIBUTE_BOX_REPLAY, should_filter=True
• red_492_getattr_state_replay stayed valid
• red_493_getattribute_state_replay stayed valid
• red_18_simple_namespace_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 97
• Blue submission: 69
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25244004467

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.