fix: anchored times shift only while still running at save start (#2730)

Follow-up to #2729.

## Problem

At load, `ReadAnchoredTime` shifted **every** anchored value forward by the downtime, including values that were already in the past when the save started. That caused two problems.

**An expired deadline came back.** A deadline that passed 5 minutes before a 30-minute outage loaded 25 minutes in the future. For example:
- `Sheep.NextWoolTime`: a sheep that was ready to shear stopped being ready.
- `PlayerVendor.NextPayTime`: an overdue payment was pushed back.
- `BaseCreature.SummonEnd`, the spell fields' `End`, `TransientItem.Expiration`, and the ChampionSpawn times could move the same way.

**Records were rewritten for nothing.** The first save after every restart rewrote:
- stamps of things that had already happened: VirtueContext's `LastHonorUse`, `LastSacrificeGain`, the four `Last*Loss` stamps, and `Corpse.TimeOfDeath`
- every deadline that had expired long ago.

## Change

- **`IGenericReader.AnchoredTimeOrigin`** is the loaded save's start time.
  - `GenericEntityPersistence` and `GenericPersistence` set it from `World.LoadedSaveStartTime`.
  - `BufferReader`, `UnmanagedDataReader` and `BinaryFileReader` expose it.
- **`ReadAnchoredTime` returns any value at or before the origin exactly as saved.**
  - A deadline still running at save start is shifted as before and keeps its remaining time.
  - Readers without an origin keep the old behaviour.
- **This covers every anchored field, including generated ones.** Generated `[AnchoredDateTime]` fields call `reader.ReadAnchoredTime()`, so the one change covers all 26 generated fields as well as the manual reads. `[DeserializeTimer]` only restores timers that were running at save time, so it is unaffected.
- **The `[AnchoredDateTime]` section of `dev-docs/serialization.md` and the `WriteAnchoredTime` doc comment describe the new rule.**

## Behaviour change

Downtime now counts toward windows measured from a past stamp:

| Window | Length |
|---|---|
| Honor use | 5 minutes |
| Sacrifice gain | 1 day |
| Virtue atrophy | 7 days |
| Instanced corpse looting | 3 minutes |

A 30-minute outage makes a 7-day atrophy fire about 0.3% sooner. No format change.

## Tests

New tests in `AnchoredTimeTests`:
- A deadline running at save start keeps its remaining time.
- A deadline that passed before save start stays passed.
- A past stamp is not shifted.
- A value exactly at save start is not shifted.

`Server.Tests`: 845 passed. `UOContent.Tests`: 1140 passed.

Projects/Server.Tests/Tests/Serialization/AnchoredTimeTests.cs

@@ -67,6 +67,63 @@ public class AnchoredTimeTests
 
         Assert.Equal(local.ToUniversalTime(), read(TimeSpan.Zero).ReadAnchoredTime());
     }
+
+    private static readonly DateTime SaveStart = new(2026, 8, 22, 12, 0, 0, DateTimeKind.Utc);
+
+    private static IGenericReader ReadSaved(BufferWriter writer, TimeSpan downtime) =>
+        new BufferReader(writer.Buffer) { AnchoredTimeShift = downtime, AnchoredTimeOrigin = SaveStart };
+
+    [Fact]
+    public void AnchoredTime_DeadlineRunningAtSaveStart_KeepsItsRemainingTime()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+        var deadline = SaveStart + TimeSpan.FromMinutes(20);
+        var downtime = TimeSpan.FromHours(3);
+
+        writer.WriteAnchoredTime(deadline);
+
+        Assert.Equal(deadline + downtime, ReadSaved(writer, downtime).ReadAnchoredTime());
+    }
+
+    /// <summary>
+    /// A deadline that had passed before the save must stay passed. Shifting it brought an expiry
+    /// back into the future whenever the downtime was longer than the time since it expired.
+    /// </summary>
+    [Fact]
+    public void AnchoredTime_DeadlinePassedBeforeSaveStart_StaysPassed()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+        var expired = SaveStart - TimeSpan.FromMinutes(5);
+
+        writer.WriteAnchoredTime(expired);
+
+        Assert.Equal(expired, ReadSaved(writer, TimeSpan.FromMinutes(30)).ReadAnchoredTime());
+    }
+
+    /// <summary>
+    /// A stamp of something that already happened (a last-use time) is never shifted, so its
+    /// bytes survive a restart and downtime counts toward its window.
+    /// </summary>
+    [Fact]
+    public void AnchoredTime_PastStamp_IsNotShifted()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+        var lastUse = SaveStart - TimeSpan.FromDays(2);
+
+        writer.WriteAnchoredTime(lastUse);
+
+        Assert.Equal(lastUse, ReadSaved(writer, TimeSpan.FromHours(1)).ReadAnchoredTime());
+    }
+
+    [Fact]
+    public void AnchoredTime_ValueAtSaveStart_IsNotShifted()
+    {
+        var writer = new BufferWriter(new byte[64], true);
+
+        writer.WriteAnchoredTime(SaveStart);
+
+        Assert.Equal(SaveStart, ReadSaved(writer, TimeSpan.FromHours(1)).ReadAnchoredTime());
+    }
 }
 
 internal class AnchoredEntity : ISerializable