fix(ci): stage coherent QPK pin propagation

[Pigbibi]

Summary

• advance QPK_PIN to 68fcad8c68ab without rewriting the still-coherent aggregate bundle
• split propagation into strategy-first and broker/QMT consumer phases
• fail closed until every strategy main pins the staged QPK commit
• reconcile broker/QMT QPK and strategy pins together, including QmtPlatform
• validate each downstream dependency closure with uv pip install --dry-run

Root cause

The previous workflow rewrote only the QPK line in qsl-pins.txt, while the pinned strategy commits still declared QPK 3acab1923a97. Pip correctly rejected that mixed bundle with ResolutionImpossible, so QPK_PIN could never land and downstream strategy PRs could never start.

Verification

• 14 passed (test_update_qpk_pin_workflow.py, test_qpk_pin_consistency.py)
• Ruff passed
• actionlint 1.7.12 passed
• git diff --check passed
• QPK 68fcad8c68ab install dry-run passed
• CN strategy staged pin dry-run passed
• consumer phase correctly PARKED while strategy mains still pin 3acab1923a97

No live authority, trading logic, Binance, or OCI changes.