Add current QSL compatibility scope and dependency identity checks

[Pigbibi]

What changed

Adds an explicit current compatibility scope for live consumer declarations while preserving the existing frozen bundle audit. Current checks require every declared Git dependency to be present and identical in pyproject.toml and uv.lock, reject invalid or unmanaged sources, and keep dependency direction fail-closed. Research-only AIAuditBridge is exempted only when both the manifest and uv lock prove it belongs exclusively to the research extra.

The lifecycle workflow now runs current checks by default, retains frozen manual checks, records current checkout SHAs, and performs a temporary exact-SHA identity checkout for CN's existing research dependency without adding it to the audited repository set.

Validation

• 33 focused QRT tests passed
• py_compile passed
• actionlint passed
• git diff --check passed
• Workflow-layout regression verifies four consumer current checks and rejects core-to-strategy direction

No deployment, workflow dispatch, or runtime verification was performed.