Keep witness freshness on the verifier clock

[aruintelligence]

Summary

• The browser Worker verifier ignores a sender-provided now and chooses its freshness clock inside the worker.
• Direct witness results record a local invocation timestamp and whether the freshness clock was supplied by the caller. Report checked_at uses that recorded local timestamp; a positive report refuses a caller-supplied test clock.
• Report step checks require an own true property, so inherited JavaScript properties cannot create passed checks.
• Exercise clock spoofing in both directions through the actual worker message handler, inherited options, and delayed report assembly.

Local verification

• 919/919 tests passed
• Project-authored JavaScript/Python signed-quorum comparison passed
• Proof, API stability, installed-package consumer compatibility, CLI contract, package artifact, local links, proof surfaces, and git diff --check passed

These are local results; GitHub CI is pending. The worker's clock is a local machine observation, not a trusted timestamp or independent certification. Signed-quorum internal validity and threshold acceptance remain separate.