Port jsonwebtoken not-before claim semantics

Scope

Port Bun corpus position 4009, js/third_party/jsonwebtoken/claim-nbf.test.js.

Acceptance criteria

• Signing validates numeric/string notBefore, rejects incompatible payload kinds and duplicate nbf, and derives the claim from iat or the active clock.
• Explicit nbf validation and copied non-finite-number serialization behavior match upstream.
• Verification supports clockTimestamp, clockTolerance, and ignoreNotBefore.
• NotBeforeError has the correct JWT inheritance and retains activation time, claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT claim, and permanent diagnostics pass.

Completed in f170c192e and pushed to main.

Home now passes all 58/58 assertions in Bun corpus position 4009, js/third_party/jsonwebtoken/claim-nbf.test.js. Signing strictly validates numeric/string notBefore, rejects incompatible payloads and duplicate nbf, derives activation from iat or the active clock, and preserves the copied non-finite serialization cases. Verification validates raw claims and honors clockTimestamp, clockTolerance, and ignoreNotBefore.

NotBeforeError now has the correct JsonWebTokenError inheritance. Inactive-token failures retain ERR_JWT_VERIFY, claim nbf, operation jsonwebtoken.verify, activation date, original cause, and readable operation/cause stack frames.

Verification:

• focused not-before file: 58 passed, 0 failed, 0 todo, 0 unsupported
• adjacent JWT claim positions 4004–4009: 267/267
• permanent third-party diagnostic contracts: 9/9
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed