fix(receiver): guard idle watchdog clock underflow

[Betafer]

Summary

Fix the unsigned idle-watchdog underflow reported in #156, where a short timestamp reversal is interpreted as nearly UINT64_MAX milliseconds and disconnects a healthy session.

The elapsed-time calculation is moved into a small testable helper. When the current monotonic value is lower than the saved activity timestamp, the watchdog rebases the timestamp instead of expiring the connection.

The receive path also refreshes last activity from a new monotonic reading after data is drained, so both values used by the watchdog come from the same clock source.

Scope

• isolated watchdog helper and tests
• no protocol or timeout changes
• normal ten-second stale-session cleanup is preserved

Verification

• rebased onto maint-3.5 at v3.5.1-rc.3
• 12 focused watchdog checks cover normal, exact-timeout and 52 ms backward-jump cases
• Receiver make test: 654 total checks; all pass
• full Receiver build succeeds

Closes #156.