Filestream bases `clean_inactive` on process start time, not file update time

Filestream's `clean_inactive` parameter is supposed to clean up old registry entries when the file is too old to ingest, and unchanged for the specified time interval. However, rather than using the file's actual update time, it uses either the file's update time or Filebeat's startup timestamp, whichever is later.

This means that for example, if Filestream is configured to clean up registry entries after 14 days, it will never clean them up unless Filebeat itself runs continuously for 14 days with no restarts.

Start by tracing Filestream's clean_inactive handling and identify where the file update time and Filebeat startup timestamp are compared. Verify the cleanup decision against the file's actual update time, and confirm the behavior with a regression test covering restarts and the configured inactivity interval.

Written by the indexing model from the issue text.