chore: pin QPK 5d4 in CN strategy

[Pigbibi]

Summary

• align pyproject.toml and qsl.toml to exact QPK main 5d4bbd0e7ef9a1434010e8b6a69905d39ee55f1b
• regenerate uv.lock with repo-native uv lock
• preserve the existing strict-v2 caller surface and fail-closed legacy HOLD behavior

Verification

• baseline exact-base: 77 passed
• uv lock --check; dependency sync/install with dependencies; uv pip check
• focused entrypoint/risk: 18 passed
• full repo: 77 passed
• Ruff, compile, package build, exact wheel dependency install
• strict-v2 import + synthetic invalid fail-closed; legacy caller valid + approval action hold
• exact three-file scope, diff/secret gates clean

No evidence, runtime, workflow, deployment, provider, credential, broker, order, paper, shadow, or live behavior changes.

[Pigbibi]

Closing unmerged and PARKED: natural CI run 30959135003 fails the QPK pin-consistency gate because QPK current main still publishes QPK_PIN=230854059c11 while this bounded strategy-first slice must pin exact QPK main 5d4bbd0e7ef9. Any fix requires a non-authorized QPK or workflow path outside pyproject.toml/qsl.toml/uv.lock; no rerun or remediation performed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbff0fcea7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".