Manual review request: evolink-nodes 1.0.3 / 1.1.0 / 2.0.0 flagged by the same 2 YARA rules previously batch-approved for 1.0.x

## Node info

- Registry node ID: `evolink-nodes` (publisher: `evolink`)
- Repository: https://github.com/deeplearning-goethe/comfyui-evolink
- Flagged versions: **1.0.3**, **1.1.0**, **2.0.0**
- Currently served latest: 1.0.2 (Active) — users get an outdated 2-node version instead of the current 56-node release.

## What the scan flagged (from `include_status_reason=true`)

I pulled the scan reports via `GET /nodes/evolink-nodes/versions?include_status_reason=true`. All findings are severity **info**:

Common to 1.0.3 / 1.1.0 / 2.0.0 — identical to the findings on 1.0.0 / 1.0.1 / 1.0.2, which were already **batch-approved by admin** (batch `232286de`):

1. `$env_read2` → `os.environ.get(` in `nodes/config.py` (reads the `EVOLINK_API_KEY` env var — one of the documented ways users provide their API key)
2. `$http1` → `requests.get(` in `nodes/task_utils.py:21` (downloads the generated image/video result from the EvoLink API)

2.0.0 only — two extra hits from dev-time scripts that were accidentally packaged:

3. `$http2` → `urllib.request.urlopen(` in `tools/extract_api_params.py`
4. `$importlib_direct` → `importlib.import_module(` in `tools/test_registry.py`

## Context

This is the official API client for EvoLink (api.evolink.ai), an AI image/video generation service. Pure API node pack: no eval/exec, no subprocess, no runtime pip installs, no obfuscation. Findings 1–2 are the unavoidable core of any API node (env-var key + result download) and were already reviewed and approved on 1.0.0 / 1.0.1 / 1.0.2.

For findings 3–4 we have already shipped a fix: `.comfyignore` now excludes `tools/` from the package (deeplearning-goethe/comfyui-evolink@dec0656), and we are publishing **2.0.1** with that packaging fix — it is back to the same 2-finding baseline as the approved 1.0.x versions.

## Request

Could you please review and approve the flagged versions — at minimum **2.0.1** (or 2.0.0), so `latest` serves the current release? Happy to adjust anything needed for compliance. Thanks!

Start by reading how ComfyUI-Manager scans node packages, reports YARA findings, and handles manual review or approval; the issue does not name those code entry points or tests. Verify how prior approvals and the excluded tools/ package affect the reported findings for evolink-nodes, especially 2.0.1. Done means the requested current release can be served as latest after appropriate review and approval.

Written by the indexing model from the issue text.