fix(supply-chain): treat only == / <= as version pins in requirements.txt (#294)

[Mark2Mac]

What

_extract_packages_from_requirements recorded the captured version for any operator, so a floor like pillow>=10.0.0 was stored as the exact release 10.0.0. The OSV/CVE lookup then attributed that release's vulnerabilities to a dependency that pins nothing — a false CRITICAL supply-chain finding.

Only == and <= bind a dependency to a concrete, CVE-checkable release. >=, >, !=, ~= are floors/ranges. The fix applies the same guard already used by _extract_packages_from_setup_py (m.group(2) in ("==", "<=")), so the two extractors agree.

Reproduction (before)

$ printf 'pillow>=10.0.0\n' > requirements.txt && printf -- '---\nname: r\ndescription: r\n---\n' > SKILL.md
$ skillspector scan . --no-llm --format json -o out.json
$ jq -r '.issues[]|select(.category=="Supply Chain")|"[\(.severity)] \(.finding)"' out.json
[LOW] pillow>=10.0.0
[CRITICAL] pillow==10.0.0   # <- the floor, rewritten as a pin, with 10.0.0's CVEs

Test

Added test_extract_packages_requirements_specifier_is_not_a_pin: asserts ==/<= keep the version while >=, ~=, != and bare names yield None. Verified red before the fix (pillow came back '10.0.0'), green after. Full existing suite for the analyzer stays green (320 passed).

Fixes #294

[rng1995]

[Automated SkillSpector Review]

Requesting changes because the new guard still treats non-exact constraints as concrete installed versions. <=8.1.0 admits every earlier release, and ==1.* is also a wildcard range, so either can still be sent to the vulnerability lookup as a version the dependency may not install. Please retain only truly exact pins, or model ranges explicitly, and add regressions for both cases.

[rng1995]

<= is still a range, not a concrete release: pkg<=8.1.0 can install any earlier version, so keeping 8.1.0 here continues the same false CVE attribution. The regex also accepts wildcard equality such as pkg==1.*, which is not exact either. Please retain only a non-wildcard exact equality (or model ranges explicitly), and update both extractors consistently.