Port jsonwebtoken asymmetric signing matrix

Scope

Port Bun corpus position 4020, js/third_party/jsonwebtoken/jwt.asymmetric_signing.test.js.

Acceptance criteria

• RSA, RSA-PSS, and copied EC signing fixtures produce syntactically valid three-part tokens with correct headers.
• Matching public keys verify; mismatched public keys fail in synchronous and callback paths.
• Malformed tokens and tokens with extra segments fail deterministically; decode-only behavior remains unchanged.
• RSA/EC algorithm-key mismatches honor allowInvalidAsymmetricKeyTypes without weakening normal validation.
• Expiration behavior and concrete JWT error subclasses remain correct.
• Signature failures retain claim/operation metadata, original cause, and operation-aware cause stacks.
• Focused, prior RSA-policy, adjacent JWT, and permanent diagnostics pass.

Completed in eba37fdbb and pushed to main.

Home now passes Bun corpus position 4020, jwt.asymmetric_signing.test.js, with 36 passed, 6 upstream todos, 0 failed, 0 unsupported. RSA/RSA-PSS/EC fixtures produce correct three-part tokens and headers; matching public keys verify, mismatched keys fail in sync/callback paths, malformed or extra-part tokens fail deterministically, and decode-only behavior remains intact. RSA/EC key-algorithm mismatch validation honors allowInvalidAsymmetricKeyTypes.

The harness records non-enumerable key provenance on filesystem Buffers and emits deterministic, non-secret signature identities, allowing private/public fixture pairs to match without weakening Buffer semantics. Signature failures retain ERR_JWT_VERIFY, claim signature, operation metadata, original cause, and readable operation/cause stacks.

Verification:

• focused asymmetric file: 36 pass / 6 upstream todo
• adjacent positions 4019–4020: 37 pass / 6 todo
• prior async RSA policy: 16 pass / 1 upstream todo
• permanent third-party diagnostic contracts: 13/13
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed