Marinebeast

Lovely hack so far, its difficulty is just right if not a bit troublesome up until you get the VS Seeker! 
It would be really cool if the added legendaries did have unique battle music, but I haven't quite gotten to them yet. Either way, I'm really enjoying it, it's been more than a decade since I've visited gen 4, and this is a great way to do it.

One thing I've been thinking about, that I would like to see, is a legalizer/legalizing method for all the Fairy-types and Pokemon with attacks/abilities that are edited from gen 4 vanilla games, for the sake of ripping the .pk4s out of the save file and putting them on other games? While the main Pokemon in this game that I wanted to shiny hunt (the three event Pokemon) are perfectly legal (well, two of them at least), it would be nice to have some sort of auto-legalizer method (whether ingame or external) that could take the manual PKHeX editing out of the process.
It being manual won't stop me, but it would be nice to see, in case someone plays this hack and wants to drop their favorites into other games. I've seen other ROM hacks that have in-game legalizers so their Pokemon can go safely onto vanilla games, so the idea stuck with me for a hack as big as this one.

It IS possible, however, to get a GBA flashcart and put event distribution ROMs on it, which will then work as intended.
Be sure to do your research on whether you need wireless or a link cable for the ROM in question, of course, and know what games they can connect with.

I'm really excited for this, I was hoping we'd get something like it. Even with a travel bag, the Switch is.. a bit clunker than I'd like it to be, so the focus on portability and easy trading is very nice. I just hope that HOME in general is free, since you're already paying your yearly $5/equivalent for Bank functionality.

It being a means to move Pokemon from Go to Sword/Shield also sounds fantastic-- here's hoping that Pokemon from Go will keep event moves and other things that keep them unique. It makes for a pretty cool reason to collect a whole bunch of Pokemon from Go over time.
I know there was worry about that being potentially game-breaking, but most officially-competitive formats don't allow anything that isn't from the core games' native region. It's pretty rare to see an online (or real-life) competition that allows Pokemon from past generations or from Virtual Console / elsewhere. And even so, most of the "weird" attacks on Go stuff aren't game-breaking in the slightest from what I've seen. It's all just typical stuff like Ice Beam on Lapras, Body Slam on Snorlax, and the elemental Hyper Beams on starters... which all of those can learn in the core games anyways. 

Tapu Lele is shiny-locked for its wild encounter in both S/M and US/UM, unfortunately.
The only available shiny Tapu Lele is from an event, which you can find here!

Do you have a 3DS/2DS? You can install custom firmware on it that will allow you to extract save files from DS and 3DS games. I personally recommend Checkpoint as the app: it's quick, easy to use, and has a very consistent file/folder structure where it puts output files. You can easily find a download for it over here, and if you don't already have a 2/3DS with CFW installed, http://3ds.guide is a good, straightforward site that walks you through the process. 
(CFW also allows you to rip ROMs from cartridges, so all may not be lost for your HeartGold cartridge depending on how corrupted it is.)

Otherwise, there's a few external DS save adapter tools out there that can grab the save file and hook it right up to your computer, the best-known one being the NDS Adapter Plus. I personally have no experience with it and I've heard of it being able to overheat to dangerous levels, but it may be cheaper than outright buying a 2DS/3DS for homebrew.

Interesting method of distribution there. More accessible than serial codes, since hypothetically someone can just get a good picture or scan of the QR code and distribute it online... but requiring a whole special app for that? It's just strange. I certainly hope it's not just a one-time thing and will be used in the future for event Pokemon.

Still, nice to see the event made available here, I was considering hunting down serial codes for the Korean distribution.

Qwilfish can certainly be found on Routes 12 and 13, cross-checking between Bulbapedia, Serebii and my own gen II games.
It has essentially the same encounter data for 32, 12 and 13, found exclusively at level 40 alongside the more common Magikarp and Tentacool.

I'm having the same legality issue with Route 12 + Route 13 Qwilfish here, but not having the moves issue replicate on my end.
The moveset for lv40 Qwilfish will always be Minimize / Water Gun / Pin Missile / Take Down, so PKHeX shouldn't be throwing a fit about moves regardless of where the Qwilfish was found.

The save file you attached looks perfectly fine, no issues.
What kind of Deoxys are you trying to spawn in, though? Is it a Birth Island Deoxys or an event distribution (SPACE C, etc) one? The fine details matter greatly in this case, and if you don't do it properly, then the game won't treat it as legitimate.

I personally recommend that you search the Downloads database for a gen 3 event Deoxys that fits your needs (there's two on this page), and inject it into your Colosseum save file. It's a lot easier than creating one from scratch.

Route 25 allows Meowth up to level 14 to spawn, according to serebii.net.

Because the routes so smoothly intersect without physical barriers, it's very likely that a Meowth on Route 25 may have spawned at level 14 and then moved over the threshold into Route 24, where it was then caught. I don't know if there's many routes like this-- the first that come to mind are water routes and Cycling Road + its connected areas-- but they could be worth study for future PKHX legality checks.

PKHeX can support more minimal ROM hacks, but ones with more significant changes may be corrupted or simply not work. If they have custom moves, items, locations or species, then it's not going to like that in the slightest.
I've been able to edit a Crystal Clear v1.2b .sav of mine, for example. PKHeX treats it as a normal Crystal save due to how much of the original game and content is preserved. (The only issues I found were incorrect displays for a couple PC boxes, but it didn't harm anything.) But it'll still toss a fit about all the Pokemon obtained in ways that they cannot be obtained in the vanilla game (Crystal Clear has a lot of modified wild data, Game Corner prizes, alternate starter choices etc), or if they have moves that are not available to them in the original. I don't know anything about Liquid Crystal, but it may just have content that PKHeX is allergic to.

I'd love to see editors for ROM hacks out there, though. Being able to properly fiddle with my assorted Touhoumon .sav files would be excellent.

Alternate ending #3: you edit the maps on the ROM so that there's no necessity for HMs, as it was in the Crystal Clear hack.

This would involve things such as removing HM-related objects (cut trees, strength and rock smash boulders), making bridges over water, and possibly coming up with more unique options to get to water-heavy areas. Alternatively/additionally, have very easy access to a Move Deleter and/or Move Reminder.

Crystal Clear, as you know, did all of this very effectively: it removed most boulders and cut trees, added in small land bridges in some places as well as paths to get around waterfalls, and rigged up an easy ferry system that would take the player to areas such as Cianwood City and Cinnabar Island. You only needed HMs for fully optional content such as the Dragon's Den*, the Whirl Islands, Mt. Mortar, and things like items behind cut trees or rock smash-encounter Pokemon.
You never had to use HMs if you didn't want to, and the Move Deleter was accessible from early on rather than at the end of the game. In my recent 100% playthrough, the only HM I actively used was Surf, but I could easily swap other HMs onto my team thanks to there being a Move Reminder NPC in the game to re-teach whatever move I deleted.

* _{yes I know it's not optional in gsc + hgss, but in Crystal Clear, it was edited so Clair just gives the player the badge rather than sending them on a proof of worth quest. bless}

It appears it's going to be a Wi-Fi distribution, at least according to its entry over here. I'm a little skeptical about the distribution dates listed there, as May 3rd and 4th are a pretty short window for a Wi-Fi event, but I suppose we'll see in a little less than a month. 

Other than OT and ID Number, they're just clones of the Legends 2018 ones. (Gold Bottle Cap for a hold item, Classic Ribbon, random nature+IVs, etc.) It's kind of a shame that they're copy-pasted like that, but it's nice to see that other countries are getting easy access to lv100, reset-able legendaries, since it's especially relevant for VGC this year.

Do the nature/IVs of these Pokemon matter to you?
I can get you the Tapu Lele and Mimikyu if you still need them, but I'd prefer not to reset too many times for them.
 

My best recommendation is to just not use the same PID and set of information for an assortment of different Pokemon in the first place. Depending on how XD generates its Pokemon, it may just be impossible for the game's Hitmonlee to have that specific PID while other Pokemon can have it due to their specific circumstances. Specific combinations of IVs, nature, species, and gender (if applicable) may simply not work, depending on how the RNG in XD is rigged up. 

Hypothetically, it should work as long as you're keeping everything completely accurate (met level, encounter location, etc). But gen 3 RNG + PID creation can be a bit whacky at times... and copy-pasting PID across different species is already getting into messy territory with editing.

I cannot name your exact problem here, but it shouldn't surprise that some of your results are flagged as illegal when you're making edits that range into the very implausible (multiple different Pokemon having the same PID).

In generation 3 (and 4), PIDs are extremely finicky things. IVs, nature, species, encounter type, and other factors all impact the PID, and you definitely cannot copy-paste a PID from one Pokemon to another and expect it to completely work. I would instead suggest taking the Hitmonlee you caught in your save and edit it, rather than copying Hitmonchan's information and building a Hitmonlee out of it.

PKHeX in general can be a bit odd with Colo/XD. I've had PKHeX mark completely legitimate stuff from my Colosseum save with the "Encounter Type PID Mismatch" status, even though the only edits were de-evolving starters and whatnot. In a later update, that supposed illegality was completely gone. 

However, if you want a functional but not fully legal Pokemon, the Hitmonlee you built will likely be perfectly usable and legal ingame. The games rarely seem to care about minor issues like this, even if they're implausible or impossible in the games proper.