Preserve clock sources in mixed timer schedules

[PLN]

A timer combining OnBootSec/OnStartupSec with OnCalendar or OnUnitActiveSec could fire its relative trigger early after a forward wall-clock adjustment. The combined timestamp was interpreted entirely as wall time. Retain the accepted wall deadline separately, compare each clock source independently, and record the source that actually became due. Calendar planning remains outside the decision lock; admission, retry and current-arm checks are preserved.

Both permanent regressions fail on current main: four relative/wall combinations fire early, and both wall-trigger forms record the wrong scheduled time. The fix passes twenty combined clock/capacity repetitions and twenty repetitions of the final new tests. Full uncached race tests passed (manager 61.405s, journal 42.385s, timers 3.370s), plus vet and Windows/Linux staticcheck. Complete source/test/documentation/privacy/whitespace review passed. Operations now documents combined-trigger clock behavior.

Exact source 6311cb1429bc3d02f990820fbd8cfb4eb2a3167b passed all Windows/Linux lanes in CI 34770433652. All 68 consolidated cases passed three repetitions per SYSTEM/headless standard-user identity without skips. Four binary hashes and source/module identity were verified; final fixture/process/profile/linger cleanup passed. Raw evidence is retained privately. The hosting broker and real pilot remained unchanged. This fixes the identified mixed-clock defect; broader R5 timer delivery, suspend/DST and operational acceptance remain open.