repart: clamp copied timestamps to $SOURCE_DATE_EPOCH

Use the new copy timestamp clamping mechanism from the previous commit
to fix unreproducible wall-clock files in the generated images.

That covers both modes: online mode writes through the kernel, and
offline mode stages the tree in a temporary directory before handing it
to mkfs or mcopy. `mcopy -m` then carries the clamped mtimes into the
FAT.

This complements commit 34c3d57474 (directory times) and commit
f191ca982c (FAT insertion order).

Cover all combinations (online/offline, with and without epoch) in the
new `testcase_vfat_reproducibility()`. Update `testcase_make_symlinks()`
to cover the symlink creation/re-fix their parent directory code paths.

Sadly, images are still not reproducible byte for byte. Document
systemd-repart's $SOURCE_DATE_EPOCH handling and remaining
reproducibility issues in the manpage.

man/systemd-repart.xml

@@ -803,6 +803,36 @@
     </variablelist>
   </refsect1>
 
+  <refsect1>
+    <title>Environment</title>
+
+    <variablelist class='environment-variables'>
+      <varlistentry>
+        <term><varname>$SOURCE_DATE_EPOCH</varname></term>
+
+        <listitem><para>Takes a UNIX timestamp in seconds. Clamps access and modification times written
+        into the image. See the
+        <ulink url="https://reproducible-builds.org/specs/source-date-epoch/">reproducible builds
+        specification</ulink>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v262"/></listitem>
+      </varlistentry>
+    </variablelist>
+
+    <para>Byte-for-byte reproducible images require <option>--offline=yes</option> mode. Populating a file
+    system through the kernel writes metadata that cannot be corrected from userspace afterwards.</para>
+
+    <para><varname>Format=</varname><literal>vfat</literal> images have additional noise: the
+    directory entry of the volume label is written with a wallclock timestamp by
+    <citerefentry project='man-pages'><refentrytitle>mkfs.fat</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+    with dosfstools versions up to and including 4.2. A later release or a backport of the
+    <ulink url="https://github.com/dosfstools/dosfstools/commit/8da7bc93315c">upstream fix</ulink>
+    sets it to <varname>$SOURCE_DATE_EPOCH</varname>.</para>
+
+    <para>Offline and online mode also write <literal>vfat</literal> short names differently, so images
+    built in both ways never match each other.</para>
+  </refsect1>
+
   <refsect1>
     <title>Exit status</title>