fix: eliminate Linux build clock skew from RTC/NTP race

Linux clones could boot with the RTC interpreted as local time (guest
runs hours ahead of UTC). NTP then steps the clock backward at runtime,
landing after source mtimes were stamped, so make reported "Clock skew
detected" and future-dated files.

- build run: enable NTP and block until NTPSynchronized before stamping
  the sources, so the backward correction happens pre-touch. Drop
  `hwclock -s`, which read the local-time RTC and pushed the clock further
  ahead.
- template prepare-linux: set-local-rtc 0 so clones interpret the RTC as
  UTC and boot at the correct time; NTP then only nudges, never steps 2h.

Linux/SSH path only; WinRM branch untouched.

src/ci_orchestrator/commands/template.py

@@ -1736,6 +1736,27 @@ def template_prepare_linux(
             )
         click.echo("[prepare-linux] machine-id cleared — clones get unique DHCP ID.")
 
+        # ── Step 7c: Enable NTP time sync (clock-skew guard for clones) ──────
+        # Bake persistent NTP into the snapshot so every clone boots and
+        # corrects its clock automatically. Without this, a clone whose RTC
+        # drifted behind the host produces source mtimes "in the future" and
+        # make emits "Clock skew detected". This is the clean fix; the build
+        # path also force-syncs + touches sources as a runtime safety net.
+        click.echo("[prepare-linux] Step 7c — Enabling NTP time sync ...")
+        # set-local-rtc 0 forces the RTC to be interpreted as UTC. Without it
+        # a clone can boot hours ahead (RTC in local time read as UTC); NTP
+        # then steps the clock *backward* at runtime, which is what produces
+        # the "Clock skew detected" / future-mtime warnings in make.
+        rc_ntp, _, err_ntp = _pl_run(
+            client,
+            "sudo timedatectl set-local-rtc 0 2>/dev/null; "
+            "sudo systemctl enable --now systemd-timesyncd 2>/dev/null; "
+            "sudo timedatectl set-ntp true",
+        )
+        if rc_ntp != 0:
+            raise click.ClickException(f"enabling NTP failed (exit {rc_ntp}):\n{err_ntp}")
+        click.echo("[prepare-linux] NTP time sync enabled.")
+
         # ── Step 8: Graceful shutdown ─────────────────────────────────────────
         if do_snapshot:
             click.echo("[prepare-linux] Step 8 — Sending graceful shutdown ...")