docs(qsl): separate bundle and rollout version sources

[Pigbibi]

Summary

• Define distinct sources for bundle targets, verified consumer pins, and the next QPK candidate.
• Remove stale hard-coded SHA lists from the central upgrade guide.
• Keep matrix validation focused on per-consumer pyproject and lockfile coherence instead of a manually copied global snapshot.

Validation

• Ran the two targeted internal dependency matrix tests.
• Ran git diff --check.

No runtime target, deployment, or trading configuration is changed.