Function extract_boot_time 

pub fn extract_boot_time<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
) -> Result<BootTimeEstimate>

Extract boot time from the kernel timekeeper struct.

Reads tk_core (or timekeeper) symbol, then extracts:

• xtime_sec (wall-clock seconds since Unix epoch at dump time)
• wall_to_monotonic.tv_sec (negative offset from wall to monotonic)
• offs_boot (nanoseconds spent in suspend, ktime_t/s64)

Returns boot_epoch = -wall_to_monotonic.tv_sec - offs_boot/1e9.