Port jsonwebtoken HMAC signing and verification matrix

Scope

Port Bun corpus position 4021, js/third_party/jsonwebtoken/jwt.hs.test.js.

Acceptance criteria

• HS signing rejects asymmetric keys, missing payloads, and non-plain options while defaulting to HS256 for valid calls.
• Valid secrets verify; wrong secrets, unsigned none tokens, null inputs, malformed/trailing-space tokens, and expired tokens fail through concrete JWT errors.
• ignoreExpiration and complete synchronous/callback paths remain correct.
• HMAC key-policy failures retain code, algorithm/operation metadata, original cause, and operation-aware cause stacks.
• Focused, asymmetric/JWT regressions, and permanent diagnostics pass.

Completed in fed4f128f and pushed to main.

Home now passes Bun corpus position 4021, jwt.hs.test.js, at 14/14. HS signing rejects asymmetric keys, undefined payloads, and non-plain options; valid calls default to HS256. Verification covers correct/wrong secrets, unsigned none tokens, null inputs, expiration/ignore-expiration, trailing-space corruption, and sync/callback paths.

HMAC key-policy failures retain ERR_JWT_SIGN, algorithm HS256, operation jsonwebtoken.sign, the original cause, and readable operation/cause stacks.

Verification:

• focused HMAC file: 14/14
• asymmetric + HMAC positions 4020–4021: 50 pass / 6 upstream todo
• permanent third-party diagnostic contracts: 14/14
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed