fix(image): keep the Tor onion reachable on RTC-less boards

An RTC-less Pi boots at 1970; Tor then rejects the consensus and the unlock
onion never publishes. Bake a clock floor (build epoch) into the initramfs and
jump the clock forward to it before Tor starts, and pass a numeric tor_ntp= in
the cmdline so busybox ntpd syncs without DNS. Proven on hardware: the onion
unlock succeeded on a Pi 3 after this.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_tor.py

@@ -174,6 +174,7 @@ class TestInitramfsToolsBackend:
         assert "root=/dev/mapper/cryptroot" in cmdline
         assert "root=PARTUUID=abcd-02" not in cmdline
         assert "ip=::::pi:eth0:dhcp" in cmdline
+        assert "tor_ntp=" in cmdline
         assert cmdline.count("\n") == 1  # cmdline must stay a single line
         assert "auto_initramfs=1" in (session.boot_mount_path / "config.txt").read_text()
 
@@ -209,3 +210,11 @@ class TestInitramfsToolsHookHardening:
         premount = self._read("tor_premount")
         assert '. "$conf"' not in premount
         assert "sed -n 's/^IPV4DNS" in premount
+
+    def test_hook_stamps_a_clock_floor(self):
+        assert "/etc/tor-clock-floor" in self._read("tor_hook")
+
+    def test_premount_raises_clock_to_floor_before_ntp(self):
+        premount = self._read("tor_premount")
+        assert "/etc/tor-clock-floor" in premount
+        assert premount.index("tor-clock-floor") < premount.index("ntpd")