Port jsonwebtoken key-ID header semantics

Scope

Confirm permanently covered positions 4012–4014 and port Bun corpus position 4015, js/third_party/jsonwebtoken/header-kid.test.js.

Acceptance criteria

• keyid signing options accept only strings, including explicit-undefined rejection.
• Valid key IDs populate the JWT kid header for object, Buffer, and string payloads; omitted key IDs leave the header absent.
• Key-ID signing failures retain code, algorithm/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT, and permanent diagnostics pass.

Completed in 07a351df9 and pushed to main.

Bun corpus positions 4012–4014 remain green and permanently covered: decode 1/1, encoding 3/3, and expiration format 1/1. Position 4015, header-kid.test.js, is fully ported at 20/20. keyid now requires a string (including explicit-undefined rejection), writes kid for object/Buffer/string payloads, and remains absent when omitted.

Invalid key IDs retain ERR_JWT_SIGN, algorithm HS256, operation jsonwebtoken.sign, the original cause, and readable operation/cause stack frames.

Verification:

• positions 4012–4015: 25/25
• permanent third-party diagnostic contracts: 11/11
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed