PR #19036
Head 04d0d5296a062c76f2f4007be28b6a494668290a
Base 1451e7cb23034d29774338608368a15d8845df36
Before: 49 existing tests pass; two real CloudLink signing regressions added -> 49 pass, 2 fail.
Ahead 600 seconds: verifier rejects future iat 1800000600 at relay time1800000000.
Behind 600 seconds: verifier rejects expired exp1799999700 at relay time1800000000.
After:51 tests pass; proof iat1800000000,exp1800000300 for both.
Related existing EnvironmentLinker, RelayTokens, linkChecks suites:19 pass.
Scoped lint, formatting, server typecheck and diff checks pass.

Direct Node runtime: actual CloudLink.linkProof -> actual RelayTokens and EnvironmentLinker services.
Only Effect clock varies; machine clock remains unchanged.
Synthetic fixture users/keys/state only. Isolated in-memory link/credential/replay adapters; no external network, deployed relay, real account, production state or native client.
{"hostSkewSeconds":600,"malformedChallengeFallback":"host time preserved","iat":1800000000,"exp":1800000300,"linked":"env-skew","persistedLinks":1,"credentialsCreated":1,"wrongUserRejected":"verify_challenge","scopeEscalationRejected":"authorize_capabilities","replayRejected":"consume_proof_nonce","reusedChallengeRejected":"consume_challenge_nonce"}
{"hostSkewSeconds":-600,"malformedChallengeFallback":"host time preserved","iat":1800000000,"exp":1800000300,"linked":"env-skew","persistedLinks":1,"credentialsCreated":1,"wrongUserRejected":"verify_challenge","scopeEscalationRejected":"authorize_capabilities","replayRejected":"consume_proof_nonce","reusedChallengeRejected":"consume_challenge_nonce"}
PASS: real CloudLink -> real RelayTokens/EnvironmentLinker; isolated in-memory persistence, credential and replay adapters; no HTTP, Clerk login, deployed relay, tunnel provisioning or native client exercised.