feat: report consumer pin PR CI status

[Pigbibi]

What

Show a display-only CI state beside each current generated consumer dependency PR: GREEN, PENDING, FAILED, NON_GREEN, or MISSING.

Why

Consumer PRs intentionally remain proposal-only because they can deploy platforms or modify data pipelines. The rollout summary should make a blocked dependency closure visible without turning the workflow into an auto-merge mechanism.

Safety

• Read-only reporting; no consumer PR is merged, closed, labelled, or otherwise mutated.
• Excludes the report script and its tests from the QPK package-pin trigger, so this operational improvement does not cause an unnecessary dependency rollout.

Verification

• uv run --extra dev python -m pytest -q tests/test_report_consumer_qpk_pin_prs.py tests/test_update_qpk_pin_workflow.py (8 passed)