fix(detector): detect bool method replay

[prasannakotyal]

Summary

Targets KG red #195, where custom_kernel uses a custom object's __bool__ method as the replay guard, then returns state stored inside that same object from the first input.

This adds a narrow BOOL_METHOD_REPLAY detector. It requires:

• a local class defining __bool__
• a module-level instance of that class
• an entrypoint mutating one of that instance's attribute containers from input-derived data
• an input-independent truthiness guard over the same instance
• a call-free replay body returning a subscript of the same attribute container

Plain bool holder lists, bool(tuple_state), and bool(dict_values) replay stay out of scope.

KernelGuard-Red-Submission: 195

Local verification

• red_81_bool_method_replay -> BOOL_METHOD_REPLAY, should_filter=True
• red_66_bool_holder_replay stayed valid
• red_297_tuple_bool_replay stayed valid
• red_296_bool_dict_values_replay stayed valid
• clean fixtures in eval_blue_patch.py stayed valid
• uv run python -m py_compile kernelguard.py

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 99
• Blue submission: 71
• Result: passed
• Target red submission caught: True
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25244067302

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.