Spell a UTC commit time one way, whichever git produced it

[MongLong0214]

Closes #650.

The defect

committedAt is a documented field of the --json output, and its value was a raw slice of git's %cI. Git changed how it renders a zero offset, so one commit object reads two ways:

$ GIT_COMMITTER_DATE="2026-02-01T00:00:00Z" git commit --allow-empty -m x

git 2.50.1 => 2026-02-01T00:00:00Z
git 2.39.5 => 2026-02-01T00:00:00+00:00

git >= 2.9 is the floor this product declares (runtime-git-trailers.ts:25), and 2.39.5 is Debian stable's git. A consumer comparing strings, matching a pattern, or feeding a strict parser gets different answers about one repository depending on the machine that answered.

The fix

Canonicalised where the value is produced — all three places, so the scan path and both index readers cannot drift apart from each other while agreeing with git.

Only the UTC spelling is touched. A real offset says where the commit was made and is left exactly as git wrote it.

Why not at the JSON boundary

The index stores the same field. Canonicalising only on the way out would leave the two routes disagreeing with each other rather than with git — trading one inconsistency for a worse one.

Negative control

Making the function return its input reproduces the failure; restoring it passes. 224 cases across git, stale and query.

Ordering is untouched: %ct is the sort key and this never sees it.

Found by

Running the suite inside node:22.23.2-bookworm while diagnosing something unrelated. CI never saw it because git-matrix runs only ubuntu-latest and macos-latest, both of which carry a recent git — a matrix that exists to vary git, not varying it across the range the product claims. That half is recorded in #650 and is not fixed here.

[github-actions]

CommitLore — record lint

Trailers: clean — 5 commits in origin/main..9fa1922bbfc1e7fc58807b8a91cd48d30fcf3644
Active constraints: not read — commitlore: git log --follow accepts exactly one pathspec, so renames are not followed for 13 paths; query one path at a time to follow its rename chain (13 changed paths)

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}