Reject non-canonical timestamps in Timestamp.Scan

time.Parse accepts a comma before fractional seconds, so Scan took
"2026-10-03T12:37:05,123Z" and Value then wrote it back with a period.
Scan now requires the parsed instant to re-format byte-identically to
its input, and the rejection test covers the comma form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/time.go

@@ -47,6 +47,9 @@ func (t *Timestamp) Scan(src any) error {
 	if err != nil {
 		return fmt.Errorf("store: scan Timestamp %q: %w", s, err)
 	}
+	if parsed.Format(timestampLayout) != s {
+		return fmt.Errorf("store: scan Timestamp %q: want %s", s, timestampLayout)
+	}
 	t.Time = parsed
 	return nil
 }

internal/store/time_test.go

@@ -60,7 +60,10 @@ func TestTimestampRejects(t *testing.T) {
 	if _, err := (Timestamp{}).Value(); err == nil {
 		t.Error("zero Timestamp Value succeeded")
 	}
-	for _, src := range []any{nil, int64(0), []byte("2026-10-03T12:37:05.123Z"), "2026-10-03T12:37:05Z", "2026-10-03T08:37:05.123-04:00", "garbage"} {
+	for _, src := range []any{
+		nil, int64(0), []byte("2026-10-03T12:37:05.123Z"), "2026-10-03T12:37:05Z",
+		"2026-10-03T08:37:05.123-04:00", "2026-10-03T12:37:05,123Z", "garbage",
+	} {
 		var ts Timestamp
 		if err := ts.Scan(src); err == nil {
 			t.Errorf("Scan(%#v) succeeded", src)