[Pigbibi]

The previous QRS action pin includes tracked host-specific node_modules symlinks in its source archive, which can prevent GitHub from initializing the action snapshot. Adopt the repaired QRS source commit 2eef9296e1ca5c214213ec71a74059cf1d5014d9.

This changes one uses SHA in the existing execution-report heartbeat workflow. The action and projection implementation blobs are unchanged; package manifests, lockfiles, frozen dependency resolution, permissions, conditions, schedule, matrix and business steps remain unchanged.

Validation reused for this exact candidate:

• Scoped independent review: PASS_SCOPED for the one-line reference update.
• Exact one-line diff, YAML syntax and AST equivalence except the action SHA, git diff --check, and actionlint 1.7.12 passed.
• pyproject.toml and uv.lock blobs and hashes remain unchanged. The existing composite action uses the same Python standard-library projection.
• Publication verifies the reviewed tree, single parent and workflow blob. No implementation tests or dependency installation are repeated locally.

Natural CI results are reported in this PR's checks. No workflow rerun, dispatch, deployment or live heartbeat is requested. This PR does not establish consumer action download/extraction or heartbeat recovery; adoption and runtime verification remain separate decisions.