fix(snapshot): make v1 rootfs timestamps portable

[Koh0920]

What changed

• generate the v1 guest-rootfs timestamp normalization command with POSIX/BSD-compatible touch -t
• force UTC so the fixed timestamp has the same meaning on every producer host
• reject the previous GNU-only touch -d spelling in the focused unit test

Why

The v1 build producer runs this export script on the host. macOS ships BSD touch, which does not accept GNU -d @1, so otherwise valid Capsule builds failed before an execution lock and Ready-State image could be minted.

Impact

macOS and Linux producers now use the same fixed epoch while preserving the existing execution contract and guest image policy.

Validation

• cargo test -p snapshot the_pack_pins_what_it_can_of_the_artifact_without_claiming_byte_equality -- --nocapture
• built and verified multiple v1 Ready-State Capsule images on macOS using the patched producer