fix(sdk): preserve repeated array query parameters

[andrei-hasna]

Summary

• serialize OpenAPI array query parameters as repeated keys with URLSearchParams.append
• preserve one set for scalar values and omit empty arrays plus null/undefined query values
• add a generator-level runtime regression with a literal comma-bearing tag

Fix Once evidence

• RED: bun test tests/sdk.test.ts -> rc=1, 2 pass / 1 fail / 14 assertions; received ["red,blue,green"] instead of ["red", "blue,green"]
• GREEN: bun test tests/sdk.test.ts -> rc=0, 3 pass / 0 fail / 18 assertions
• full package gate: bun run verify:release -> rc=0, 1358 pass / 7 skip / 0 fail / 13767 assertions; generated artifacts current, conformance/build/dist smoke/isolated consumer/pack/artifact scan passed
• staged and origin/main..HEAD gitleaks scans -> rc=0, zero findings

Scope and provenance

• Todos task: 3a732d10-4f7e-48a9-b68e-ce3d32fe31e3 (DUB-00034)
• Source review artifact: https://github.com/hasnaxyz/iapp-knowledge/pull/12#issuecomment-5242006177
• This PR fixes the owning generator only; it does not publish contracts or regenerate/update dependent Knowledge artifacts.

Compatibility note

The runtime change applies to every generated client when a query value is an array, matching OpenAPI form-query default repeated-key semantics. No explicit explode: false use was found across current hasna or hasnaxyz code search; explicit non-default query serialization remains unsupported by this generator and is the residual compatibility risk.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

Independent adversarial review — GO

Exact candidate reviewed:

• Base: 89c63aabe6b38d2fc63c78589d1a6f21862c03bc
• Head: b3cc6fb35d81983880b5f9d60b7eeb90d8e8e31a
• Tree: 54b0d58c73430327cc3dd3e851b35c22e401f3b2
• Changed surfaces: src/sdk/generate.ts, tests/sdk.test.ts

Verdict: GO — zero unresolved in-scope P0/P1 behavior, security, integrity, or compatibility defects.

Evidence checked:

• Exact PR identity remained unchanged and merge state was CLEAN immediately before this verdict.
• Focused lane: 3 pass, 0 fail, 18 expect() calls; direct exit focused_rc=0.
• Runtime probe of generated code preserved scalar false/zero/empty-string values, emitted primitive arrays as repeated keys in order, encoded comma and space values correctly, and omitted empty arrays plus null/undefined values. Actual entries included ["flags","false"],["flags","true"], ["counts","0"],["counts","2"], and ["texts","a,b"].
• The regression expectation is discriminating: the prior String(array) plus set path would produce one comma-flattened value and cannot satisfy getAll("tags") === ["red", "blue,green"].
• Protected CI run 31403648343 is attached to the exact head and completed successfully. Its literal test summary is 1356 pass, 8 skip, 0 fail, 13759 expect() calls; verify:release reports the same. Secret scan reports no leaks found.
• Built dist/sdk/generate.js contains the repeated-key searchParams.append branch, so the package export built by the release path carries the fix.
• The concrete downstream Knowledge contract declares tags as a primitive string array with style: form and explode: true, and its server reads getAll("tags"); this candidate now matches that contract without comma loss.

Non-blocking P2 follow-up: the generator still does not model non-default OpenAPI query style/explode combinations. This verdict covers the claimed and currently reachable default/form explode: true primitive-array contract only; no supported current path requiring a different serialization was demonstrated.