Port jsonwebtoken audience claim semantics

Scope

Port Bun corpus position 4004, js/third_party/jsonwebtoken/claim-aud.test.js.

Acceptance criteria

• The copied jsonwebtoken test-utils helper resolves and checks sync/async parity.
• Signing validates audience, rejects conflicting payload claims and invalid payload forms, and emits aud correctly.
• Verification accepts matching strings, regexes, and arrays against string/array payload audiences.
• Mismatches return JsonWebTokenError with the upstream message in sync and callback forms.
• Verification failures retain operation/claim context, original causes, and readable stacks.
• Focused, neighboring JWT, and permanent diagnostics pass.

Completed in 056985780 (feat(third-party): port JWT audience claims) and pushed to main.

Implemented the copied jsonwebtoken test-utils parity contract, concrete JsonWebTokenError/TokenExpiredError types, callback/synchronous verify overloads, audience signing validation, payload conflict checks, and string/regex/array audience matching across string and array aud claims.

Verify failures preserve the expected upstream message while adding ERR_JWT_VERIFY, claim: "aud", operation metadata, the original cause, an explicit jsonwebtoken.verify frame, and a stable cause header. Audience mismatch behavior is now part of the always-run third-party error diagnostic.

Verification:

• claim-aud.test.js: 60 passed, 0 failed, 0 unsupported
• positions 4003–4004: 61 passed, 0 failed
• copied sync/async sign and verify parity checks: passing
• permanent audience instance/code/claim/cause/stack assertions: passing
• permanent corpus accounting, Hono/http2-wrapper/gRPC errors, SQL adapters, and third-party diagnostics: all passing
• zig fmt --check and git diff --check: clean

Cumulative executable ledger through position 4004: 346 files, 3,003 passed, 219 todo, 0 failed, 0 unsupported, 171 explicitly allowed-empty.

Closed by 056985780; all 60 audience cases and permanent claim diagnostics are green.