fix: encode persisted semantic recovery audit timestamps

[acidkill]

Summary

• Canonicalize SurrealDB datetime values while hashing the prior semantic recovery audit marker.
• Add a real SurrealDB integration regression for timezone-aware recovered_at round trips.

Why

The guarded stale-source recovery passed preflight but execute stopped before its conditional checkpoint update because the existing audit marker returned a Python datetime, which plain JSON cannot encode. This change encodes datetimes as ISO strings and continues to reject unsupported audit values. The production checkpoint was verified unchanged after the failed attempt.

Test plan

• pytest tests/ -m "not stress" -n 2: 7736 passed, 176 skipped, 1 xfailed in a clean environment.
• Explicit loopback SurrealDB 3.2.4 and focused units: 21 passed.
• ruff check src/ tests/ and ruff format --check src/ tests/ clean.
• mypy src/ --ignore-missing-imports clean.
• scripts/sync_refs.py --check and git diff --check clean.
• Re-run production recovery only after independent PR review, green CI, exact image, and verified backup.

Verified by

@acidkill.