podcertcontroller: derive the test clock from the CA it verifies against

[NekoPunch (orangeCatDeveloper)]

Fixes #1150

TestMakeCert fails intermittently because verification runs one second before the generated CA becomes valid, causing the leaf's certificate chain to be rejected.

testNow was sampled at package initialization, before the CA existed, while the CA's NotBefore was sampled later by GenerateED25519CA. x509 encodes times at whole-second precision, so if a second boundary fell between those samples, the CA's encoded NotBefore was one second later than testNow and verification ran before the CA was valid.

The test clock now comes from the CA the test just built, so the two instants can no longer be ordered by chance. The four call sites each use their own CA, keeping the fix local to the tests and avoiding a production change. NotBefore is parsed back from DER and is already whole-second, so nothing has to truncate.

Deriving it also separates the injected clock from wall time by a minute, which is what a fixed clock is for: with the old testNow a signer that reached for time.Now() instead of the injected clock produced almost the same timestamps and went unnoticed.

Independent processes, since testNow was a package-level variable and only a fresh process resampled it:

before   7 / 3000 failed   (0.23%)
after    0 / 3000 failed
Fisher two-sided p = 0.0156

Positive control — forcing the clock one second behind reproduces CI's message verbatim:

forced:   current time 2026-08-22T12:20:03Z is before 2026-08-22T12:20:04Z
CI:       current time 2026-08-20T20:23:03Z is before 2026-08-20T20:23:04Z

Mutation check, replacing h.clock.Now() in the signer with a wall-clock read:

mutant                                      before   after
time.Now()                                  caught   caught
time.Now().UTC().Truncate(time.Second)      missed   caught

• Tests pass
• Appropriate changes to documentation are included in the PR