SAFETY_WINDOW_MS

Conservative grace assumed when the live dust_grace_period isn't plumbed through. The ledger default is 3h; we treat the usable window as a fraction of that so a slightly stale sync-time (which still resolves to our root and is preferable for 170 safety) is retained, while a genuinely idle one is clamped well before the real 3h edge. There is no native getter for dust_grace_period (only global_ttl), so this is intentionally smaller than any realistic grace.