Timekeeper: Install chronyd as BlueOS tool

[juliusz-t]

Summary by Sourcery

Add chrony time synchronization tooling to BlueOS and ensure its binaries are included in the core image.

New Features:

• Provide chronyd and chronyc as bundled BlueOS system tools for time synchronization and NTP serving.
• Add a bootstrap script to build and install static chrony binaries for CI and tooling workflows.
• Introduce a default chrony configuration tailored for BlueOS vehicle networks and shared host clock usage.

Build:

• Include chronyd and chronyc in the core Docker image via static binary installation tooling.

Chores:

• Register chrony in the system and static tools installation scripts so it is set up alongside existing BlueOS tools.

[cursor]

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="core/tools/chrony/chrony.conf" line_range="15-16" />
<code_context>
+# Serve NTP to devices on the vehicle network. Restrict to typical BlueOS subnets.
+# TODO(chrony): drive these from settings / detected interfaces.
+allow 192.168.2.0/24
+allow 192.168.0.0/16
+allow 10.0.0.0/8
+
+# Even with no upstream source, act as a stratum-10 server so vehicle-network
</code_context>
<issue_to_address>
**🚨 issue (security):** Broad NTP "allow" ranges may expose the time service more widely than intended

These broad `allow` ranges expose NTP to most private networks reachable from the container. In deployments where those ranges include non-vehicle devices, this could serve time to unintended clients and increase attack surface. Please narrow the ranges to the specific subnets you expect (or make them configurable) and avoid redundant overlaps like `192.168.2.0/24` plus `192.168.0.0/16`.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

🚨 issue (security): Broad NTP "allow" ranges may expose the time service more widely than intended

These broad allow ranges expose NTP to most private networks reachable from the container. In deployments where those ranges include non-vehicle devices, this could serve time to unintended clients and increase attack surface. Please narrow the ranges to the specific subnets you expect (or make them configurable) and avoid redundant overlaps like 192.168.2.0/24 plus 192.168.0.0/16.