Follow-ups from #914: outbox age-window boundaries, retry shutdown test, skew tolerance #921

Follow-ups from the review of #914 (non-blocking), tracked here as one issue.

Age-window boundaries (drainOutboxWithStats, outbox.ts)

1. Neither endpoint of the young window is pinned: changing ageMs > -OUTBOX_FUTURE_SKEW_MS && ageMs < OUTBOX_PARTIAL_GRACE_MS to >=/<= leaves outbox.test.ts green. Add a fake-clock test with mtimes exactly at now + OUTBOX_FUTURE_SKEW_MS, just inside it, and exactly at now - OUTBOX_PARTIAL_GRACE_MS.
2. The text is one boundary off at both ends. An mtime exactly 1 s ahead is quarantined, and an age of exactly 5000 ms is quarantined. Either make the code inclusive at the skew end (with the test above) or make the text say "1 s or more in the future" and "at least the grace old": plugins/openclaw-tps-mail/src/index.ts (~329, ~927, ~1029, ~1395, ~2345), plugins/openclaw-tps-mail/test/dispatcher-reply.test.ts (~383, ~387), packages/cli/src/utils/outbox.ts (~133 "down to"), packages/cli/test/outbox.test.ts (~291, ~301).

Retry scheduler
3. No test drives runStart's shutdown call to outboxYoungRetry.cancel() or the pickTarget lambda; deleting the shutdown cancel turns nothing red.

Design questions
4. A writer can re-stamp a file's mtime to stay within the young window on every pass and keep it from being quarantined. The cost is bounded (one retry timer per grace period, and the retry only re-runs the pass); decide whether a per-file skip count should cap it.
5. The 1 s future-skew tolerance was measured on a local filesystem only; a network filesystem with clock skew may need more.

Stale text this PR did not change
6. writeOutboxFile's "calls drainOutbox() on EVERY directory event" and the "with this exact function" import comments.

Refs #913, #914.