mavlink: clamp persisted timestamp at save time too, to prevent +15s drift

The previous fix raised signing.timestamp on load to max(saved+15s, now)
but the save path still persisted whatever signing.timestamp held — and
in a session with no successful send_message (e.g. a child where the
first incoming packet gets rejected and so nothing is forwarded onward),
signing.timestamp stays at the loaded value of saved+15s and gets
written straight back. Each load+save cycle then ratchets the stored
key.timestamp by another 15s ahead of real time. After enough sequential
short-lived sessions the stored value parks far enough in the future
that the next session's first incoming packet is below
signing.timestamp - MAVLINK_SIGNING_TIMESTAMP_LIMIT seconds and the
helper rejects it with MAVLINK_SIGNING_STATUS_OLD_TIMESTAMP. Once that
happens nothing forwards on that link for the lifetime of the test
suite.

Cap the persisted value at current wall clock. The +15s buffer is a
load-time replay guard against advancement lost between the previous
save and a crash; it isn't supposed to round-trip through the next
save. With the cap, the stored key.timestamp tracks real time, the
+15s buffer is reapplied fresh on each load, and per-session drift is
bounded at ~15s — never compounds across sessions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tridge

mavlink.cpp

@@ -380,12 +380,33 @@ void MAVLink::save_signing_timestamp(void)
     }
     bool need_save = false;
 
+    // Cap saved value at current real time. The +15s buffer added in
+    // load_signing_key() is a per-load replay guard; allowing it to
+    // round-trip through this save would let the buffer compound across
+    // sequential short-lived sessions until signing.timestamp parks far
+    // enough in the future that incoming packets get rejected as
+    // MAVLINK_SIGNING_STATUS_OLD_TIMESTAMP. Using the legitimate
+    // wall-clock advancement here keeps the stored timestamp in sync
+    // with reality.
+    double now_s = time_seconds();
+    const uint64_t epoch_offset = 1420070400ULL;
+    uint64_t now_mavlink = 0;
+    if (now_s > epoch_offset) {
+        now_mavlink = uint64_t(now_s - epoch_offset) * 100ULL * 1000ULL;
+    }
+
     for (uint8_t i=0; i<MAVLINK_COMM_NUM_BUFFERS; i++) {
 	mavlink_channel_t _chan = (mavlink_channel_t)(MAVLINK_COMM_0 + i);
 	const mavlink_status_t *status = mavlink_get_channel_status(_chan);
-        if (status && status->signing && status->signing->timestamp > key.timestamp) {
-            key.timestamp = status->signing->timestamp;
-            need_save = true;
+        if (status && status->signing) {
+            uint64_t v = status->signing->timestamp;
+            if (v > now_mavlink) {
+                v = now_mavlink;
+            }
+            if (v > key.timestamp) {
+                key.timestamp = v;
+                need_save = true;
+            }
         }
     }
     if (need_save) {