Add UTC-Time forensic wire provenance

[masarray]

What changed

• preserve the exact 8-byte IEC 61850 UTC-Time payload in decoded MmsDataValue.RawValue;
• reuse preserved UTC-Time wire bytes for byte-exact decode → encode round trips instead of reconstructing the fractional field from rounded .NET ticks;
• add typed Iec61850UtcTimeEvidence exposing raw hex, seconds-since-epoch, the original 24-bit fractional-second field, TimeQuality flags, accuracy code, explicit UTC display, and local display with timezone offset;
• keep synthetic/programmatically created UTC-Time values explicitly marked as having no wire provenance;
• add MmsReportTimestampEvidence to keep IED data timestamps, report TimeOfEntry, and client ReceivedAt as separate timing concepts;
• link report TimeOfEntry to raw wire evidence only when the original decoded InformationReport contains an exact display match; otherwise keep raw evidence unavailable rather than infer it;
• keep raw-provenance construction internal and validate that preserved bytes reproduce the same decoded UTC-Time value and quality;
• add deterministic regression coverage for raw-byte retention, byte-exact round-trip, TimeQuality decoding, synthetic/no-provenance behavior, source separation, explicit timezone offsets, and exact-only TimeOfEntry provenance;
• update the changelog.

Why

P0 preserves and displays sub-millisecond timestamp precision, but a forensic/dispute workflow also needs to prove what was actually present on the wire. Before this patch the decoded Iec61850UtcTime survived, but the original 8-byte payload did not. Once converted to .NET ticks, the exact 24-bit fractional field could no longer be proven or reproduced uniquely.

This P1 makes the distinction explicit between:

1. the IED data timestamp (.t or an embedded timestamp in a reported data object);
2. report TimeOfEntry;
3. local client ReceivedAt.

These timestamps are evidence from different semantic sources and must not be conflated during SOE/FAT/vendor dispute analysis.

Compatibility

• existing public MmsDataValue.UtcTime(Iec61850UtcTime) remains unchanged for synthetic/programmatic values;
• MMS decoding uses an internal validated raw-provenance factory path;
• existing timestamp display contracts are unchanged;
• P1 is stacked on draft PR Close UTC-Time P0 display precision gaps #56 so its diff is isolated from the P0 formatter/display work.

Validation

Final P1 head 4405795c99d82bf8371ca23bcd6a5644af641a6d passed .NET CI run #270 through temporary validation PR #58, because the repository workflow only runs pull-request CI for branches targeting main. Run #270 passed:

• source/provenance/wording/license verification;
• restore;
• Release build;
• complete deterministic test suite, including exact-only TimeOfEntry provenance regression;
• test diagnostics upload.

Temporary validation PR #58 was closed after CI success. Review PR #57 remains stacked on P0 branch #56 for a clean P1-only diff.

Remaining boundary

MmsReportTimestampEvidence.FromFrame(frame) can always distinguish displayed TimeOfEntry from IED/client timestamps. Exact TimeOfEntry raw-wire provenance requires the original decoded MmsInformationReport to be supplied as the optional second argument and an exact display match to be found. If that evidence cannot be established, the raw field remains unavailable rather than guessed.

[masarray]

Superseded by current-main consolidation PR #73, merged as d04fe94877679d66330c5e5bd1a83c245aa9ccb2. The forensic provenance work was selectively ported onto current main: exact decoded 8-byte UTC-Time preservation/round-trip, 24-bit fraction and TimeQuality evidence, explicit synthetic/no-wire-provenance behavior, and separation of IED timestamp / report TimeOfEntry / client ReceivedAt. PR #73 exact-head CI #317 and post-merge main CI #318 both passed. Closing this historical stacked draft; branch/commits remain preserved.