fix: prevent canonical hash collisions between empty arrays and arrays containing undefined (#18265)

## Background

The internal canonical serializer represented both [] and [undefined] as
"[]", producing identical SHA-256 hashes. No currently exploitable
public call path was demonstrated, but the collision weakened defensive
hashing used by tool approvals and fingerprints.

## Root Cause

JSON.stringify(undefined) returns JavaScript undefined, which
canonicalJSON passed through Array.map; Array.prototype.join then
coerced that result to an empty string. The reproduction confirmed
identical canonical output and digest, and the new regression tests
failed with the original implementation.

## Summary

Undefined array elements are now serialized as null before joining,
preserving their positions for root and nested arrays. A patch changeset
for ai was added.

## Testing

Added canonical serialization and hash regression tests covering empty
arrays, arrays containing undefined, and nested arrays in both Node.js
and Edge runtimes.

## End-to-end Validation

- `pnpm -C packages/ai exec tsx -e "<canonicalJSON/hashCanonical
assertions>"` observed `[]` serialize as `[]`, `[undefined]` as
`[null]`, and their hashes differ.

## Related Issues

Fixes #18157

Closes #18263

---------

Co-authored-by: ai-sdk-factory <308175966+ai-sdk-factory@users.noreply.github.com>
Co-authored-by: Lars Grammel <205036+lgrammel@users.noreply.github.com>
Co-authored-by: trmxvibs <109752684+trmxvibs@users.noreply.github.com>