chore(qsl): phase2 compat 2026.07.1 + legacy req refs

[Pigbibi]

Summary

• Update qsl.compat.bundle to 2026.07.1
• Keep legacy req/pyproject dependency refs aligned to current live commit set
• keep allow_legacy=true and enforce_bundle=false
• Sync requirements.txt, requirements-lock.txt and uv.lock
• Update qsl metadata smoke test expectation

Validation

• uv lock --check
• uv run pytest tests/test_qsl_metadata.py -q
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 35f22fdc57

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the lock-file test for the new QPK revision

With this new revision, tests/test_monthly_publish_workflow_config.py still defines QPK_DEPENDENCY with the old 0063af... hash and test_real_publish_dependency_is_locked asserts that value is present in both requirements files; CI runs python -m unittest discover -s tests -v in .github/workflows/ci.yml, so this commit makes the unit test fail (confirmed with python -m unittest tests.test_monthly_publish_workflow_config -v). Please update the test fixture alongside this dependency bump.

Useful? React with 👍 / 👎.