Improve log timestamp normalization gates

[MAUROCERON]

Implements #1422.

Summary

• Adds a timestamp normalization and clock-skew evidence gate before log correlation.
• Adds a required Timestamp Normalization Matrix to the report output so event time, ingestion/index time, parser selection, timezone, and skew confidence are documented.
• Adds edge-case fixtures for Windows local time ambiguity, CloudTrail ingestion delay, Sysmon clock skew, Linux auth timestamp gaps, parser mapping mistakes, and a complete normalized timeline.

Validation

• Verified Markdown fence balance for the updated skill and new fixture.
• Verified required markers for event time, ingestion/index time, clock-skew evidence, parser timestamp fields, Not Evaluable decisions, CloudTrail, Sysmon, and Linux auth logs.
• Verified new reference URLs with live checks: AWS 200, Splunk 200 via curl, Elastic 200.
• Verified no private payment details are present in the workspace.

Payment details can be provided privately after maintainer acceptance.