Port jsonwebtoken asynchronous signing semantics

Scope

Port Bun corpus position 4002, js/third_party/jsonwebtoken/async_sign.test.js.

Acceptance criteria

• jwt.sign supports callback forms with and without an options object.
• Async and sync signing return equivalent tokens for equivalent inputs.
• none, RSA, and PS algorithm validation matches the copied suite, including minimum RSA modulus policy and allowInsecureKeySizes.
• Temporal claims honor mutatePayload, invalid arguments reach callbacks, and falsy secrets return the expected error.
• jws.decode exposes the original payload text.
• Async failures retain algorithm/operation context, original causes, and readable stacks in the permanent diagnostic gate.

Completed in 4ae083cf6 (feat(third-party): port async JWT signing) and pushed to main.

Expanded the shared JWT adapter with callback argument normalization, async callback delivery, deterministic sync/async token parity, none algorithm headers, RSA/PS key validation, minimum RSA modulus enforcement with allowInsecureKeySizes, temporal claims, mutatePayload, invalid option handling, falsy-secret errors, and a jws.decode payload contract.

Signing failures preserve the upstream-facing message while adding ERR_JWT_SIGN, algorithm and operation metadata, the original cause, an explicit jsonwebtoken.sign operation frame, and a stable cause name/message. Async RS256 validation is now asserted in the always-run third-party error gate.

Verification:

• async_sign.test.js: 16 passed, 0 failed, 1 upstream skip/todo, 0 unsupported
• positions 4001–4002: 17 passed, 0 failed, 1 upstream todo
• existing JWT mini-suite regressions and permanent async signing error diagnostics: passing
• permanent corpus accounting, Hono/http2-wrapper/gRPC errors, SQL adapters, and third-party diagnostics: all passing
• zig fmt --check and git diff --check: clean

Cumulative executable ledger through position 4002: 344 files, 2,942 passed, 219 todo, 0 failed, 0 unsupported, 171 explicitly allowed-empty.

Closed by 4ae083c; all async signing cases and permanent cause/stack diagnostics are green.