Function finalize_at 

pub fn finalize_at(
    reg: &LoadedRegistry,
    run_dir: &Path,
    completed_at: DateTime<Utc>,
) -> Result<Manifest>

Like finalize, but with an injectable completion clock. The CLI path uses finalize (wall-clock); tests pin completed_at so the coverage math (on-time vs late) is deterministic instead of drifting with the calendar.