Port jsonwebtoken signing schema validation

Scope

Port Bun corpus position 4029, js/third_party/jsonwebtoken/schema.test.js.

Acceptance criteria

• Signing accepts only the supported none, HS, RS, PS, and ES algorithm enum values.
• header must be an object, encoding a string, and noTimestamp a boolean when provided.
• Registered exp claims require numeric seconds while retaining valid fractional numbers.
• Schema failures retain code, algorithm/operation metadata, original cause, and operation-aware cause stacks.
• Focused, algorithm-family regressions, and permanent diagnostics pass.

Implemented and pushed in 8db9cbe (feat(third-party): port JWT schema validation).

What landed:

• signing algorithm validation is restricted to the jsonwebtoken schema enum (none, HS*, RS*, PS*, ES*)
• header, encoding, and noTimestamp now enforce their upstream option types
• schema failures retain ERR_JWT_SIGN, operation=jsonwebtoken.sign, algorithm context, the original cause, and a stable caused-by stack section
• the exact Bun file is now part of the permanent third-party JWT mini-suite

Verification:

• position 4029 js/third_party/jsonwebtoken/schema.test.js: 5 passed, 0 failed/todo/unsupported
• positions 4028–4029: 9 passed, 0 failed/todo/unsupported
• permanent third-party error diagnostics: 17 passed
• full always-on JWT/utility mini-suite: passed

This advances the contiguous full-corpus boundary through position 4029: 371 files, 3,385 passed, 225 todo, 0 failed, 0 unsupported (171 allowlisted empty files).