Well, IANAL but tweets aren't legislation. What that tweet implies is something that would have to be amended into the NDAA, which requires congress. Hegseth can't just go on a drunk rant and have everything out of his mouth become law.

The supply chain risk directive would come from existing procurement law, which only allows the DoD to require contractors to certify that Anthropic is not used in the fulfillment of any government work.

Which is also separate from Trumps' EO, which being an EO only applies to the federal government directly.

So yeah, banning any contractor, supplier, or partner from any commercial activity with Anthropic is just fantasy without going through congress first.