offboard: give watchdog grace period from when setpoints start

[julianoes]

Problem

OffboardImpl::process_heartbeat() stops setpoint streaming when the vehicle is not in offboard mode more than 3 seconds after _last_started:

if (!offboard_mode_active && _mode != Mode::NotActive &&
    _time.elapsed_since_s(_last_started) > 3.0) {
    stop_sending_setpoints();
}

However, _last_started is only ever written in start(). Before the first start() call it is still default-initialized (epoch 0), so the 3-second guard is always satisfied. Any heartbeat that arrives between the first set_*() and start() therefore resets the setpoint state, and start() fails with NoSetpointSet — even though the caller followed the documented sequence (set a setpoint, then start).

How it was found

In real-time use the window between set_*() and start() is almost never hit by a 1 Hz heartbeat. In lockstep simulation with a speed factor it becomes frequent: at speed factor 30, PX4's heartbeats arrive every ~33 ms of wall time, and the PX4 SITL integration tests ('Offboard attitude control') failed on Offboard::start() returning NoSetpointSet roughly one run in three.

Fix

Stamp _last_started whenever streaming transitions out of NotActive (new note_setpoints_started() helper, called at each mode transition under the existing lock). The watchdog's grace period then covers the gap between the first setpoint and start(), matching the intent of the existing "we make sure we don't stop too eagerly" comment. Watchdog behaviour is otherwise unchanged: streaming without a successful start() still gets stopped, just 3 seconds after it began rather than on the next heartbeat.