Port jsonwebtoken expiration claim semantics

Scope

Port Bun corpus position 4005, js/third_party/jsonwebtoken/claim-exp.test.js.

Acceptance criteria

• The Sinon fake-clock import uses Home's timer runtime and supports install/tick/uninstall.
• jws.sign creates raw tokens for claim-validation fixtures.
• expiresIn validates numbers/timespan strings, detects payload conflicts, and derives exp from iat or the current clock.
• Verification enforces numeric expiration with clock timestamp/tolerance and ignore-expiration behavior.
• Errors remain concrete JWT error types with claim/operation/cause stack context.
• Focused, adjacent JWT, and permanent diagnostics pass.

Completed in 51850a90e and pushed to main.

Home now passes all 58/58 assertions in Bun corpus position 4005, js/third_party/jsonwebtoken/claim-exp.test.js. The port includes Sinon-compatible fake-clock install/tick/uninstall behavior, raw jws.sign fixtures, strict expiresIn and exp validation, numeric and s/m timespans, iat-relative expiration, clockTimestamp, clockTolerance, ignoreExpiration, and concrete TokenExpiredError behavior.

Expiration diagnostics are permanently gated: failures retain ERR_JWT_VERIFY, claim exp, operation jsonwebtoken.verify, expiredAt, the original cause, and readable operation/cause stack frames.

Verification:

• focused expiration file: 58 passed, 0 failed, 0 todo, 0 unsupported
• adjacent audience + expiration files: 118/118
• permanent third-party diagnostic contracts: 5/5
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed