feat(deps): auto-queue verified strategy QPK pins

[Pigbibi]

Summary

• Queue only generated strategy-library QPK pin PRs after every reported CI check is successful.
• Require the current pin branch, trusted same-org author, main target, exact four-file dependency scope, and matching QPK SHA in pyproject metadata.
• Keep broker and runtime consumer PRs proposal-only to avoid deployment or trading side effects.

Validation

• Ran Python syntax checks and the direct guard test cases.
• Manually invoked the existing QPK rollout workflow test cases because pytest is unavailable on this VPS.
• Ran git diff --check.

No runtime target, deployment, or trading configuration is changed.