Address remaining audit findings: input hardening and cleanup

Security:
- SNTP replies must echo a random nonce in their originate timestamp, and
  unsynchronized (LI=3) or invalid-stratum servers are rejected, so an
  off-path spoofer cannot defeat the clock-trust gate
- The storage directory is created 0700 but an existing one is tightened
  only when it is provably ours (holds our artifacts or is empty); a
  misconfigured path like /tmp under root is left alone with a warning
- Device-supplied vendor/product names are stripped of control characters
  at ingestion so a device cannot inject terminal escapes

Cleanup:
- ensure_fabric splits into decision logic plus bootstrap_fabric
- read_device_names merges the two name readers; a From impl replaces the
  hand-mapped IdentityReport; run_sync uses map/transpose with an extracted
  manual_instant; pick_interface runs once; print_json escapes its fallback;
  device_name dedups the vendor/product join; identity_status ignores
  leftover .tmp blobs; dead parameters and repeated random-id code removed

36 unit tests, clippy clean.

0 files changed, 0 insertions, 0 deletions