fix: standard collected-value shape on the direct fast path + caller-clock timestamps

Two remaining clock/shape inconsistencies from the audit:

1. The direct fast path emitted a bare collected-value object
   {value, source, relation, userKey, objectKey} — no possibility, no
   path, no metadata. Value consumers (comparators, chains) rely on the
   self-describing shape the rule paths emit. The fast path now emits
   the standard shape (value/possibility/path/source/metadata), matching
   DirectRule's existing _createCollectedValue contract.

2. Collected-value timestamps fell back to the WALL clock (Date.now())
   even for pinned-clock callers in BaseRule._createCollectedValue,
   ChainRule, and TupleToUsersetRule. The metadata timestamp now honors
   options.now when pinned (changed_last_at wins, then pinned now, then
   wall clock). ValueContext's collectedAt remains metadata-only.

Pinned by ttl-contract.test.js: the fast-path collected value carries
the full shape and its timestamp honors the pinned clock. Rigor 251/251,
full suite 853/791/0.

src/authorization/rules/ChainRule.js

@@ -539,7 +539,8 @@ export class ChainRule extends BaseRule {
             source: relation.source || 'persistent'
           },
           {
-            timestamp: relation.changed_last_at || relation.updated_last_at || Date.now(),
+            timestamp: relation.changed_last_at || relation.updated_last_at ||
+              (options && options.now !== undefined && options.now !== null ? options.now : Date.now()),
             reliability: blurred.reliability,
             pathPossibility: currentPath.possibility,
             relationPossibility: relation.possibility ?? 1.0,