To use a UTXO one must supply correct scriptSig or "unlocking script" to the given scriptPubKey "lock script", I know the scriptSig in PTPKH locking is sig and pubkey. My question is what makes the sig be unique to the specific UTXO ? It must be, otherwise I can take it and use it in different UTXO which has the same scriptPubKey .
No, because clients use
SIGHASH_ALL in their transactions by default, which signs the outpoint you're spending in addition to the rest of the transaction.
People also sometimes add the flag
SIGHASH_ALL which still signs the outpoint you're spending.