feat: pivot to supply chain security domain (PyPI token, yaml.load, CI injection)

fix: clamp scores strictly within open interval (0, 1) per updated evaluator rules

fix: align HF_TOKEN and OpenAI client exactly with spec requirements

Initial commit: vuln-patch-env OpenEnv hackathon submission