Port jsonwebtoken verification and key-provider semantics

Bun corpus slice

• Position 4034: js/third_party/jsonwebtoken/verify.test.js

Current first failure

Unsigned alg=none tokens are emitted with a synthetic signature and surface invalid signature; upstream requires distinct jwt signature is required / explicit algorithms: ["none"] behavior.

Acceptance criteria

• reproduce signed/unsigned token policy including explicit none opt-in
• support synchronous and delayed secret/public-key provider callbacks, while rejecting provider functions in synchronous verification
• preserve provider callback failures as structured verification errors with original causes and operation stacks
• validate clockTimestamp types before claim comparisons
• emit exact asymmetric key-type/algorithm diagnostics
• keep options immutable
• focused, adjacent, and permanent JWT matrices pass

Implemented and pushed in e2a3808 (feat(third-party): port JWT verification semantics).

What landed:

• unsigned tokens now require an empty signature and explicit algorithms: ["none"] opt-in when no key is supplied
• synchronous and delayed secret/public-key providers are supported; provider functions are rejected for synchronous verify calls
• provider lookup failures retain ERR_JWT_VERIFY, claim=key, operation=jsonwebtoken.verify, and the original lookup error as cause
• consumer callback exceptions escape verbatim and cannot be rewrapped or delivered as a second JWT callback
• numeric Sinon useFakeTimers(epoch) input is honored, and clockTimestamp is type-validated
• asymmetric key-type diagnostics match the upstream algorithm lists
• the exact Bun file and two callback-ownership/cause regressions are permanent

Verification:

• position 4034: 19 passed, 1 upstream todo, 0 failed/unsupported
• positions 4033–4034: 32 passed, 4 todo, 0 failed/unsupported
• permanent third-party error diagnostics: 20 passed
• full always-on JWT/utility mini-suite: passed

This advances the contiguous full-corpus boundary through position 4034: 376 files, 3,421 passed, 229 todo, 0 failed, 0 unsupported (172 allowlisted empty files).