feat: pivot to supply chain security domain (PyPI token, yaml.load, CI injection)

fix: clamp scores strictly within open interval (0, 1) per updated evaluator rules

Initial commit: vuln-patch-env OpenEnv hackathon submission