Harden against untrusted input and reduce controller boilerplate

Security:
- Epoch conversions no longer panic on out-of-range values: a device may
  report any u64 as its clock, so to_timestamp is fallible (rendered
  labeled-raw), from_timestamp clamps a pre-epoch host clock to zero (a
  Pi with no RTC reads 1970 early after boot), and delta arithmetic
  saturates. Fixes crashes in inspect and status
- Identity Debug redacts the root CA private key so no stray {:?} leaks it
- fsync the temp file before rename, so a power loss cannot surface an
  empty identity.json
- Document in the README that device attestation is not verified, the NTP
  servers contacted, and the at-rest key

Cleanup:
- A MatterCtx extension trait replaces the repeated map_err/anyhow closure
  at every rs-matter call site with .ctx("what")
- SyncOutcome::failed/skipped constructors collapse two large literals
- read_our_fabric_entry shares the fabric-filtered read across the label,
  decommission, and inspect paths

36 unit tests, clippy clean.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/output.rs b/src/output.rs
index 4de5745..e2c91ec 100644
--- a/src/output.rs
+++ b/src/output.rs
@@ -26,7 +26,7 @@ use crate::tz::format_utc_offset;
 /// string, never as a JSON number, which silently loses precision beyond
 /// 2^53 in many consumers. The rule lives in the type, so an ID field
 /// cannot be emitted wrongly.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, PartialOrd, Ord)]
 pub struct Id64(pub u64);
 
 impl Serialize for Id64 {