Port jsonwebtoken issuer claim semantics

Scope

Port Bun corpus position 4007, js/third_party/jsonwebtoken/claim-iss.test.js.

Acceptance criteria

• Signing validates string issuers, rejects incompatible payload kinds and duplicate iss claims, and writes the claim without mutating unrelated payload state.
• Verification accepts string or string-array issuer policies and reports exact mismatch messages for missing or different claims.
• Issuer failures retain concrete JWT error identity, claim/operation metadata, the original cause, and operation-aware cause stacks.
• Focused, adjacent JWT claim, and permanent diagnostics pass.

Completed in 22c772d15 and pushed to main.

Home now passes all 28/28 assertions in Bun corpus position 4007, js/third_party/jsonwebtoken/claim-iss.test.js. Signing validates string issuer options, rejects string/Buffer payloads and duplicate iss claims, and writes the issuer claim. Verification supports exact string and string-array policies while preserving the upstream mismatch messages for missing or different claims.

Issuer failures retain ERR_JWT_VERIFY, claim iss, operation jsonwebtoken.verify, the original JsonWebTokenError, and readable operation/cause stack frames. The mismatch path is part of the permanent diagnostic suite.

Verification:

• focused issuer file: 28 passed, 0 failed, 0 todo, 0 unsupported
• adjacent JWT claim positions 4004–4007: 185/185
• permanent third-party diagnostic contracts: 7/7
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed