fix: reject malformed SMS deliver timestamps

[Justinabox]

Summary

• Reject SMS-DELIVER PDUs whenever their Service Centre Time Stamp cannot be decoded.
• Apply the existing fail-closed timestamp rule consistently to numeric originators.
• Add a regression test for an invalid numeric-originator SCTS.

Closes #290.

Verification

• git diff --check
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pyserial-asyncio pytest tests/test_sms_pdu.py -q — 59 passed
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q — 1094 passed

Risk

Malformed SMS-DELIVER frames with missing/invalid timestamps now fail closed rather than returning a message without a timestamp. Valid numeric and alphanumeric PDU regression coverage remains green.

[Justinabox]

Release review: needs-fix before landing.

The targeted malformed-calendar SCTS guard is correct, but timestamp parsing remains permissive for invalid timezone semi-octet BCD. For example, timezone byte FA is accepted and decoded to an invalid offset rather than failing closed, allowing a malformed numeric SMS-DELIVER PDU through.

Please validate BCD digits after removing the timezone sign bit, then add both direct decode_timestamp() and full numeric decode_deliver_pdu() regressions for an invalid timezone nibble such as FA. Follow a fresh RED/GREEN cycle and rerun the full repository gate.