The Downloads scan rejected any file whose mtime was newer than the scan's
Date.now() snapshot (sub-ms fs timestamps, NTP stepping the clock back), and
the ambiguity test was green only because both fixtures were skipped by that
guard. Allow 60s of future skew, add a win32 end-to-end bind test, and cover
every stamped artifact name (mac arm64/x64 dmg, windows setup exe, linux
AppImages) plus unstamped negatives in the parser test.
Electron resolves ONE install id before spawning the backend (install.json
app_install_id -> python settings installation_id -> fresh uuid) and exports
it as OPENSWARM_INSTALLATION_ID; the backend adopts it when settings has no
installation_id yet. The affiliate app_install_id and the analytics
install_id are now the same value, so affiliate refs join directly to
telemetry with no sign-in required. Drops the frontend app_install_id
forwarding through sign-in flows; the desktop auth router forwards
settings.installation_id as install_id instead.
