What's the realistic outcome here? The gov cannot label them as a supply-chain risk but still free to cancel contracts with Anthropic? Or do gov agencies has autonomy to use whoever they want?

The government is free to cancel its own contracts. The judge is saying that the government cannot prohibit other entities (like private contractors) from doing business with Anthropic.