Port jsonwebtoken JWT ID claim semantics

Scope

Port Bun corpus position 4008, js/third_party/jsonwebtoken/claim-jti.test.js.

Acceptance criteria

• Signing validates string jwtid options, rejects incompatible payload kinds and duplicate jti claims, and writes the claim.
• Verification enforces exact jwtid matches only when requested and reports upstream-compatible missing/mismatch errors.
• JWT ID failures retain concrete JWT error identity, claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT claim, and permanent diagnostics pass.

Completed in 430735fb5 and pushed to main.

Home now passes all 24/24 assertions in Bun corpus position 4008, js/third_party/jsonwebtoken/claim-jti.test.js. Signing validates string jwtid options, rejects string/Buffer payloads and duplicate jti claims, and writes the claim. Verification enforces exact JWT ID matches only when requested and preserves upstream missing/mismatch messages.

JWT ID failures retain ERR_JWT_VERIFY, claim jti, operation jsonwebtoken.verify, the original JsonWebTokenError, and readable operation/cause stack frames. The mismatch path is permanently gated.

Verification:

• focused JWT ID file: 24 passed, 0 failed, 0 todo, 0 unsupported
• adjacent JWT claim positions 4004–4008: 209/209
• permanent third-party diagnostic contracts: 8/8
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed