Generated sitemap is not escaped and is invalid if a URL has the character `&`

Link to the code that reproduces this issue

https://github.com/joulev/debug/tree/nextjs-sitemap-escape-ampersand

To Reproduce

// app/sitemap.ts
import type { MetadataRoute } from 'next';

export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
    return [
        {
            url: 'https://example.com?a=b&c=d',
            changeFrequency: 'never',
        },      
    ]
}

Current vs. Expected behavior

Current: The & is not escaped, causing the sitemap file to be invalid.

Expected: The URL should be properly escaped. Right now a workaround is required with .replaceAll('&', '&'). But, if this issue is fixed, it will break this workaround, so not even sure if that fix should belong to a new major or not.

Provide environment information

Operating System:
  Platform: linux
  Arch: x64
  Version: #25~22.04.1-Ubuntu SMP Thu Jan 16 21:37:09 UTC 2025
  Available memory (MB): 7939
  Available CPU cores: 2
Binaries:
  Node: 18.20.7
  npm: 10.8.2
  Yarn: 1.22.22
  pnpm: 10.6.4
Relevant Packages:
  next: 15.3.0-canary.15 // Latest available version is detected (15.3.0-canary.15).
  eslint-config-next: N/A
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.8.2
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Metadata

Which stage(s) are affected? (Select all that apply)

next dev (local), next build (local), next start (local), Vercel (Deployed), Other (Deployed)

Additional context

No response

Run the app/sitemap.ts reproduction from the linked branch and trace the Next.js Metadata sitemap-generation path. Confirm how URLs containing an ampersand are serialized, then verify that the generated sitemap is valid and that the expected behavior is covered without relying on the workaround.