Function build 

pub fn build(
    conn: &Connection,
    args: &ExportForensicBundleArgs,
    output_path: &Path,
    generated_at: Option<&str>,
) -> Result<()>

Build the bundle for the given memory id, writing the tarball to output_path.

generated_at overrides the RFC3339 timestamp written into the manifest. The CLI always passes None (which fills in chrono::Utc::now()); the test suite passes a fixed string to make the byte-identical reproducibility assertion provable.

Errors

Propagates I/O errors writing the tarball, signing errors when an operator key is on disk but corrupted, or substrate read errors.