fix(types): restore null sentinel for ObjectCreate / ReflectSetPrototypeOf

prefer-undefined-over-null autofix converted 5 sites where the Node API
contract requires `null` specifically:

* helpers.ts: 2× ObjectCreate(null) for null-prototype proxy targets
* normalize.ts: 1× ObjectCreate(null) for qualifiers map
* package-url.ts: 1× ObjectCreate(null) for qualifiers copy, 1×
  ReflectSetPrototypeOf(PackageURL.prototype, null) for the
  null-prototype prototype-chain root

All flipped back to `null` with inline `socket/prefer-undefined-over-null`
disables explaining the Node API constraint. tsgo check now passes.

Author: jdalton

src/helpers.ts

@@ -37,11 +37,13 @@ export function createHelpersNamespaceObject(
     ],
     comparator,
   )
-  const nsObject: Record<string, Record<string, unknown>> = ObjectCreate(undefined)
+  // oxlint-disable-next-line socket/prefer-undefined-over-null -- Object.create(null) / Reflect.setPrototypeOf(_, null) require the null sentinel.
+  const nsObject: Record<string, Record<string, unknown>> = ObjectCreate(null)
   // Build inverted structure: property -> {helper1: value1, helper2: value2}
   for (let i = 0, { length } = propNames; i < length; i += 1) {
     const propName = propNames[i]!
-    const helpersForProp: Record<string, unknown> = ObjectCreate(undefined)
+    // oxlint-disable-next-line socket/prefer-undefined-over-null -- Object.create(null) / Reflect.setPrototypeOf(_, null) require the null sentinel.
+    const helpersForProp: Record<string, unknown> = ObjectCreate(null)
     for (
       let j = 0, { length: helperNamesLength } = helperNames;
       j < helperNamesLength;

src/normalize.ts

@@ -114,7 +114,8 @@ export function normalizeQualifiers(
       continue
     }
     if (qualifiers === undefined) {
-      qualifiers = ObjectCreate(undefined) as Record<string, string>
+      // oxlint-disable-next-line socket/prefer-undefined-over-null -- Object.create(null) / Reflect.setPrototypeOf(_, null) require the null sentinel.
+      qualifiers = ObjectCreate(null) as Record<string, string>
     }
     // A key is case insensitive. The canonical form is lowercase
     qualifiers[StringPrototypeToLowerCase(key)] = trimmed

src/package-url.ts

@@ -251,7 +251,8 @@ class PackageURL {
       result.version = this.version
     }
     if (this.qualifiers !== undefined) {
-      const qualifiersCopy = ObjectCreate(undefined) as QualifiersObject
+      // oxlint-disable-next-line socket/prefer-undefined-over-null -- Object.create(null) / Reflect.setPrototypeOf(_, null) require the null sentinel.
+      const qualifiersCopy = ObjectCreate(null) as QualifiersObject
       for (const key of ObjectKeys(this.qualifiers)) {
         qualifiersCopy[key] = this.qualifiers[key]!
       }
@@ -897,7 +898,8 @@ for (const staticProp of ['Component', 'KnownQualifierNames', 'Type']) {
   })
 }
 
-ReflectSetPrototypeOf(PackageURL.prototype, undefined)
+// oxlint-disable-next-line socket/prefer-undefined-over-null -- Object.create(null) / Reflect.setPrototypeOf(_, null) require the null sentinel.
+ReflectSetPrototypeOf(PackageURL.prototype, null)
 
 // Register PackageURL with compare module for string-based comparison support.
 _registerPackageURL(PackageURL)