Harden against untrusted input and reduce controller boilerplate

Security:
- Epoch conversions no longer panic on out-of-range values: a device may
  report any u64 as its clock, so to_timestamp is fallible (rendered
  labeled-raw), from_timestamp clamps a pre-epoch host clock to zero (a
  Pi with no RTC reads 1970 early after boot), and delta arithmetic
  saturates. Fixes crashes in inspect and status
- Identity Debug redacts the root CA private key so no stray {:?} leaks it
- fsync the temp file before rename, so a power loss cannot surface an
  empty identity.json
- Document in the README that device attestation is not verified, the NTP
  servers contacted, and the at-rest key

Cleanup:
- A MatterCtx extension trait replaces the repeated map_err/anyhow closure
  at every rs-matter call site with .ctx("what")
- SyncOutcome::failed/skipped constructors collapse two large literals
- read_our_fabric_entry shares the fabric-filtered read across the label,
  decommission, and inspect paths

36 unit tests, clippy clean.

1 files changed, 15 insertions, 0 deletions

diff --git a/README.md b/README.md
index 6c70450..5037d4c 100644
--- a/README.md
+++ b/README.md
@@ -153,6 +153,21 @@ sudo -u mattertimesync /opt/mattertimesync/mattertimesync \
 
 Then `sudo systemctl enable --now mattertimesync.timer` (2 minutes after boot, hourly thereafter).
 
+## Security notes
+
+- **Device attestation is not verified.** Commissioning accepts any device's attestation
+  certificate without checking it against the Connectivity Standards Alliance's Distributed
+  Compliance Ledger (that check needs DCL access this tool does not have). Commissioning still
+  requires the device's SPAKE2+ pairing passcode, so a rogue device cannot join without it, but you
+  cannot cryptographically confirm that a commissioned device is genuine certified hardware.
+- **Outbound network traffic** is limited to Matter (UDP to the device and its border routers),
+  mDNS multicast on the local link, and the clock-trust check: one SNTP query per `sync` to
+  `time.apple.com`, falling back to `pool.ntp.org`. There is no telemetry and no other outbound
+  contact.
+- **The root CA private key** lives unencrypted at rest in `identity.json` (mode 0600 in a 0700
+  storage directory). Back it up as carefully as any private key; anyone who reads it can
+  impersonate this controller to your devices. It is never logged or included in any output.
+
 ## Migrating from the TypeScript implementation
 
 The config file and `service-state.json` carry over unchanged, but the **Matter fabric identity does