Port jsonwebtoken invalid token input semantics

Scope

Confirm permanently covered positions 4016–4017 and port Bun corpus position 4018, js/third_party/jsonwebtoken/issue_304.test.js.

Acceptance criteria

• jwt.verify rejects number, object, array, function, and boolean token inputs through both callback and synchronous paths.
• Rejections use concrete JsonWebTokenError identity instead of leaking callback exceptions or pending async tests.
• Invalid-token failures retain code, claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT, and permanent diagnostics pass.

Completed in 648480af1 and pushed to main.

Bun corpus positions 4016–4017 remain green and permanently covered (invalid_exp 5/5, issue 147 1/1). Position 4018, issue_304.test.js, is fully ported at 5/5: jwt.verify now rejects numbers, objects, arrays, functions, and booleans before decode, so callback tests settle with a concrete JsonWebTokenError instead of leaking a callback exception and appearing pending.

Both callback and synchronous failures are permanently gated with ERR_JWT_VERIFY, claim token, operation jsonwebtoken.verify, original cause, and readable operation/cause stacks.

Verification:

• positions 4016–4018: 11/11
• permanent third-party diagnostic contracts: 12/12
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed