I've just been refactoring the code, so I know :)

https://github.com/yast/yast-yast2/blob/master/library/control/src/modules/ProductControl.rb#L1328

0.) Custom control file -- probably only used on runnign system in special cases (such as Wagon)
1.) /y2update/control.xml -- Y2UPDATE is still in play
2.) /control.xml -- default installation path
3.) /etc/YaST2/control.xml -- default path to installed control file (owned by release package)