Good question. I tried what I now realise you must have tried- scheduling a shutdown and querying the systemd timers!
That showed that the shutdown was not in the systemd timers, as you noted. So then a quick perusal of the systemctl source gives us this call, as part of
r = sd_bus_call_method(
arg_action == ACTION_HALT ? "halt" :
arg_action == ACTION_POWEROFF ? "poweroff" :
arg_action == ACTION_KEXEC ? "kexec" :
(systemctl.c line 7387)
So it would appear that shutdowns are handled by
logind. You can continue to pursue the details if you like- see
login-dbus.c. There are methods there for scheduling, cancelling, managing shutdowns. But for a deeper understanding, you may need to know more about logind/systemd than I do.
Long story short, the shutdown info is stored (at least) in a schedule file at
/run/systemd/shutdown/scheduled, the contents of mine as an example were:
Indicating time (in microseconds, presumably); whether to warn via
wall, and which mode (cf restart, kexec etc).
Hope this points you in the right direction at least!