fix: emit all JSON timestamps as UTC RFC3339 via a Timestamp type

[baiirun]

JSON output from prog couldn't be reliably processed with jq. Timestamps came out in two formats: logs as UTC (2026-08-26T02:38:39Z) and learnings with the local offset they were stored with (2026-01-09T15:12:45-06:00). jq's fromdateiso8601 rejects the second form. Items had no timestamps in JSON at all, so a staleness query over list --json wasn't possible.

The cause was formatting at each call site with .Format(time.RFC3339), which keeps whatever offset the value carries.

What changed

The formatting rule now lives on a type rather than at call sites. Timestamp is a defined type over time.Time whose MarshalJSON writes UTC with whole seconds — the only form jq accepts. JSON structs declare their time fields as Timestamp, so a new field copied from its neighbors gets the right format without anyone needing to know about a helper.

• LogJSON and LearningJSON created_at are now Timestamp
• ItemListJSON and ItemShowJSON gain created_at and updated_at
• Timestamp also implements UnmarshalJSON, since the tests decode output back into these structs
• docs/adr/0001-json-timestamp-format.md records the decision, the contract, rejected alternatives, and runnable verification, so the reasoning survives refactors of the type

A plain time.Time field is not a safe substitute: its built-in MarshalJSON emits fractional seconds (…45.123456789Z), which jq 1.6 also rejects. A new field declared as time.Time would compile and look fine in review — that's the remaining gap, deliberately left to review rather than an AST-based guard test.

Before / after

learning created_at:  2026-01-09T15:12:45-06:00  →  2026-01-09T21:12:45Z
item in list --json:  (no timestamps)            →  created_at, updated_at

This now works:

prog list --status in_progress --json |
  jq -r '.[] | select((now - (.updated_at|fromdateiso8601)) > 30*86400) | .id'

Validation: new test asserts a -06:00 time with nanoseconds marshals to exactly "2026-01-09T21:12:45Z" and round-trips to the same instant. Against the real database, all 1,354 timestamps in list --json parse with fromdateiso8601.

Scope

JSON output only; text output is unchanged. The database still stores Go's time.Time.String() format, so SQL date functions still return NULL — that needs the separate _time_format=sqlite DSN change plus a migration. ready --json stays minimal without timestamps, and status still has no JSON mode.

Most of the main.go diff is gofmt realigning struct fields around the longer type name.

🤖 Generated with Claude Code