Harden against untrusted input and reduce controller boilerplate

Security:
- Epoch conversions no longer panic on out-of-range values: a device may
  report any u64 as its clock, so to_timestamp is fallible (rendered
  labeled-raw), from_timestamp clamps a pre-epoch host clock to zero (a
  Pi with no RTC reads 1970 early after boot), and delta arithmetic
  saturates. Fixes crashes in inspect and status
- Identity Debug redacts the root CA private key so no stray {:?} leaks it
- fsync the temp file before rename, so a power loss cannot surface an
  empty identity.json
- Document in the README that device attestation is not verified, the NTP
  servers contacted, and the at-rest key

Cleanup:
- A MatterCtx extension trait replaces the repeated map_err/anyhow closure
  at every rs-matter call site with .ctx("what")
- SyncOutcome::failed/skipped constructors collapse two large literals
- read_our_fabric_entry shares the fabric-filtered read across the label,
  decommission, and inspect paths

36 unit tests, clippy clean.

0 files changed, 0 insertions, 0 deletions