nexus-inventory: injectable time source for CollectionBuilder

RFD 726's simulator runs on a simulated clock, and enforces a timestamp-leak invariant: every timestamp in produced output must fall within [epoch, now] on that clock. Collections currently make that impossible: CollectionBuilder stamps time_started at construction and time_done at build via now_db_precision(), with no injection point. Input::reference_time — the "now" that diagnosis engines compare against — is exactly that time_done, so until the sim can supply it, the planner's clock moves on its own.

Note the fix should cover more than those two fields: several other now_db_precision() call sites stamp time_collected on individual items (e.g. L231, L357, L634), so a caller-supplied clock (or time source) on the builder needs to feed those too, or wall-clock readings still leak into collections.

Start in nexus/inventory/src/builder.rs at the linked CollectionBuilder construction, build, and time_collected call sites, then read nexus/fm/src/analysis_input.rs around Input::reference_time. Trace how the builder currently calls now_db_precision() and make the caller-supplied time source cover every listed timestamp. Done means collections use the supplied clock consistently, including time_done and reference_time.