feat: pivot to supply chain security domain (PyPI token, yaml.load, CI injection)

fix: add HuggingFace Spaces YAML metadata to README

Initial commit: vuln-patch-env OpenEnv hackathon submission