fix: keep a Date in log metadata instead of writing {} (2.2.1)

[cuzzlor]

Fixes #152.

What

From 2.0.0 to 2.2.0, any Date in log metadata reached every transport as {}. serializeErrorFormat runs first at the logger level, and its metadata walk rebuilds every object from Object.keys; a Date has no own enumerable keys. 1.x left metadata alone and the JSON step wrote the ISO string.

logger.info('db query', { parameters: [new Date('2026-01-02T03:04:05Z'), 1] })
// 2.2.0: { parameters: [{}, 1] }
// 2.2.1: { parameters: [Date, 1] }  → JSON: ["2026-01-02T03:04:05.000Z",1]

How

• Metadata walk (serializeErrorFormat): a value that defines toJSON — Date, URL, a date-library instance — is passed through as the same reference, as 1.x did. A transport receives the Date; the console's format.json, flatten and any other JSON step write its ISO string.
• Error serializer (serializeError): output must be plain, so a toJSON value on an error is replaced by what it returns — ISO string, null for an invalid Date, href for a URL. When toJSON throws or returns the value itself, the own-keys walk runs as before.
• An error is never asked for its toJSON, so an error class that defines one (an AxiosError, say) is still captured whole — name, message, stack and its own fields — rather than as whatever its toJSON chooses to show.
• The helper lives in an internal module that index.ts does not re-export, so the public API is unchanged.

Also: unblocks CI and publishing

Advisories published since 2.2.0 make npm run audit fail, and both the PR workflow and publish.yml run it first, so main could not publish anything. All nine are in dev tooling. A non-forcing npm audit fix clears the lockfile-only ones; vitest / @vitest/coverage-v8 move 4.1.4 → 4.1.12. The fflate fix (0.8.2 → 0.8.3) breaks attw 0.18.2's tarball parsing (Cannot read properties of undefined (reading 'filename')), so @arethetypeswrong/cli moves to 0.18.5, which targets fflate 0.8.3.

Version

2.2.1 — patch. It restores 1.x behaviour; no output that was correct in 2.2.0 changes. Publishing happens on merge (publish.yml). This should merge before the 2.3.0 OTel PR, which is stacked on this branch.

Test plan

• npm run build — lint, tsc, rollup, attw --pack, CJS smoke test
• npm test — 154 tests. The 8 new tests that exercise the bug fail against main's source and pass here; 3 guard tests (an error with toJSON in the format and in the serializer, a toJSON that throws) pass on both
• Found downstream: MakerXStudio/MakerBOS#1612 logs TypeORM timestamptz parameters and carries a workaround that this makes removable