The scope of METR and Redwood Research's independent evaluation of the OpenAI Hugging Face incident excluded OpenAI's internal governance policies