ci: fix QPK pin downstream ref check

[Pigbibi]

Summary

• Fixes the Update QPK Pin workflow failure exposed after PR ci/security/test: automated audit fixes for QuantPlatformKit #164.
• Keeps the new fail-fast behavior, but scopes strategy package checks to ref/metadata validation with --no-deps.
• Emits the first 160 lines of pip diagnostics on failure instead of hiding the reason.

Problems found

• Strategy packages currently carry their own direct quant-platform-kit SHA pins in pyproject metadata.
• A full dependency solve with the generated top-level QPK constraint conflicts until downstream strategy repos update those pins.
• The workflow should not report false success, but it also should not fail main on an expected cross-repo pin lag when the check is meant to validate generated refs.

Fixes applied

• Changed strategy dry-run checks to python -m pip install --dry-run --no-deps -c constraints.txt "$dep".
• Added comments documenting why the check is scoped this way.
• Captures pip output and prints a bounded diagnostic snippet only on failure.

Security impact

• No secrets, credentials, production settings, or permissions changed.

Architecture impact

• No runtime code changes; CI-only fix.

Tests run

• actionlint .github/workflows/update-qpk-pin.yml — passed
• Local simulation of all four strategy package checks with python3 -m pip install --dry-run --no-deps -c <tmp constraints> <dep> — all OK
• git diff --check — passed

Failed or skipped checks with reasons

• Full downstream dependency solve remains a cross-repo follow-up because strategy repos pin QPK directly.

Deployment notes

• No deployment.

Rollback plan

• Revert this PR to restore full dependency solve behavior, but that will reintroduce the current main workflow failure until downstream QPK pins are updated.

Manual follow-up checklist

• Update strategy repos to align their direct quant-platform-kit pins with the current QPK main SHA or move QPK pinning fully to shared constraints.