If pkgA delivers both kernel and userland functionality, and both sides of that interface must be updated accordingly, then whenever pkgA is updated in a non-global zone, pkgA must also be updated in any other zones where pkgA is installed.
To ensure this update is done correctly, use a parent dependency in pkgA. If a single package delivers both sides of the interface, then a parent dependency on feature/package/dependency/self ensures that the global zone and the non-global zones contain the same version of the package, preventing version skew across the interface.
The parent dependency also ensures that if the package is in a non-global zone, then it is also present in the global zone.
If the interface spans multiple packages, then the package that contains the non-global zone side of the interface must contain a parent dependency on the package that delivers the global zone side of the interface. The parent dependency is also discussed in Dependency Types.