Port jsonwebtoken RSA PEM interoperability regression

Scope

Port Bun corpus position 4019, js/third_party/jsonwebtoken/issue_70.test.js, without weakening the RSA key-policy cases already covered by asynchronous signing tests.

Acceptance criteria

• RS/PS signing accepts Buffer-backed PKCS#1 RSA private PEM input from fs.readFileSync.
• Arbitrary strings, public-only keys, wrong asymmetric KeyObjects, and insecure generated keys remain rejected under the existing policy.
• Verification accepts the matching BEGIN PUBLIC KEY Buffer fixture.
• RSA signing failures retain code, algorithm/operation metadata, original cause, and operation-aware cause stacks.
• Focused, adjacent JWT, and permanent diagnostics pass.

Completed in 7ecc73eaf and pushed to main.

Home now passes Bun corpus position 4019, issue_70.test.js, at 1/1. RS/PS signing accepts Buffer-backed PKCS#1 BEGIN RSA PRIVATE KEY PEM material loaded by fs.readFileSync, while arbitrary strings, public/wrong-type KeyObjects, and insecure generated RSA keys remain governed by the existing strict policy. The matching BEGIN PUBLIC KEY Buffer verifies successfully.

Verification:

• focused issue-70 file: 1/1
• adjacent positions 4016–4019: 12/12
• async RSA policy regression: 16 passed, 1 upstream todo, 0 failed, 0 unsupported
• permanent third-party diagnostics and full JWT/utility mini-suite: passed
• formatting and diff checks: passed