Container clocks drift more than the host admits

CLOCK_MONOTONIC inside a paused-then-resumed container skips in a way that a naive rate limiter reads as a burst. Could be a bypass primitive, could be nothing. Need a clean repro before I believe myself.