When Python Is Poisoned | How Runtime Security Stops the tj-actions Attack