feat: pivot to supply chain security domain (PyPI token, yaml.load, CI injection)

fix: clamp scores strictly within open interval (0, 1) per updated evaluator rules

ci: add GitHub Actions keep-alive workflow

fix: align HF_TOKEN and OpenAI client exactly with spec requirements

fix: add HuggingFace Spaces YAML metadata to README

Initial commit: vuln-patch-env OpenEnv hackathon submission