Port jsonwebtoken private and subject claim semantics

Scope

Permanently gate Bun corpus position 4010, claim-private.test.js, and port position 4011, claim-sub.test.js.

Acceptance criteria

• Private claims retain JSON-compatible values, null serialization for non-finite numbers, UTF-8 strings, arrays/objects, and omission of undefined.
• Signing validates string subject options, rejects incompatible payload kinds and duplicate sub, and writes the claim.
• Verification enforces exact subject matches only when requested with upstream-compatible missing/mismatch errors.
• Subject failures retain concrete JWT error identity, claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT claim, and permanent diagnostics pass.

Completed in 6a869cdb0 and pushed to main.

Bun corpus position 4010, claim-private.test.js, remains green and is now permanently gated at 19/19, including UTF-8, arrays/objects, undefined omission, and non-finite-number null serialization. Position 4011, claim-sub.test.js, is fully ported at 24/24: signing validates string subjects, rejects incompatible payloads and duplicate sub, and verification enforces exact subject policies only when requested.

Subject failures retain ERR_JWT_VERIFY, claim sub, operation jsonwebtoken.verify, the original JsonWebTokenError, and readable operation/cause stack frames.

Verification:

• focused private + subject files: 43/43
• adjacent JWT claim positions 4004–4011: 310/310
• permanent third-party diagnostic contracts: 10/10
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed