Arbitrary code execution via Hydra eval resolver

Code injection in the flash-attention training script allows attackers to execute arbitrary Python code through a malicious Hydra configuration. The script registers Python eval() as the Hydra eval resolver, so ${eval:...} interpolation evaluates configuration text as Python. Execution occurs only when the training script processes an attacker-supplied configuration and grants code execution with the script's privileges.