chore(deps): adopt QSL bundle 2026.09.1

[Pigbibi]

Summary

• Adopt QSL bundle 2026.09.1 with the authorized immutable dependency refs:
  • QPK b13e28759a880dcb446dbfbc580dc032333b065e; Us 18dc01711f0776a07903a7a6524bab5455c09fb1
• Update only current dependency metadata, qsl compatibility metadata, corresponding test constants, and uv.lock.

Validation

• uv lock --check
• python3 -m pytest -q tests/test_qsl_metadata.py (1 passed)
• git diff --check
• Exact dependency/qsl/lock assertions passed; historical evidence/artifact refs were not changed.

Safety boundary

• No workflow_dispatch, provider/replay, deployment, real orders, or paper/live activation was performed.
• This PR is intentionally not merged in this task.