auth: bind JWT verification to typed policy

[loadingalias]

What changed

• Add RsaJwtAlgorithm, a closed typed set of the six supported RSA JOSE algorithms.
• Add RsaJwtVerifier, bound to one public key and one locally selected algorithm.
• Treat protected-header alg metadata as an exact assertion; it can no longer select an RSA profile.
• Remove runtime string-to-profile mapping, direct runtime-algorithm signing/verification, and the three-value compatibility verifier surface.
• Update exports, native API guidance, allocation coverage, protocol fuzzing, and the release change fragment.

Why this shape

The old API could represent policy as independently coordinated strings and a generic signature profile. The new boundary derives the canonical JOSE name and RSA profile from one verifier-owned enum value, so inconsistent policy states are unrepresentable and peer metadata cannot widen local policy.

This remains an RSA primitive boundary, not a partial JOSE parser. Providers still own strict JSON, UTF-8, base64url, compact serialization, duplicate-member, and critical-header validation before passing one decoded protected-header alg assertion.

This is an intentional pre-v1 API break. The following compatibility/string selector methods are removed rather than deprecated or shimmed:

• RsaSignatureProfile::{from_jwt_alg,matches_jwt_alg}
• RsaPrivateKey::{sign_jwt_alg,sign_jwt_alg_with_scratch}
• RsaPublicKey::{verify_expected_jwt_alg,verify_expected_jwt_alg_with_scratch}
• RsaPublicKey::{verify_jwt_alg,verify_jwt_alg_with_scratch}

No dependency, unsafe-code, RSA arithmetic, padding, or backend changes are included.

Validation

• just check-all rscrypto
  • host formatting/check/clippy/docs
  • exhaustive feature tests
  • zeroization compiler evidence
  • Windows, Linux, IBM, and constrained cross-target groups
• just test --all
  • 1,676 tests passed; 1 intentionally skipped
  • 164 doctests passed, including the compile-fail typed-policy assertion
• just test-fuzz auth_rsa_protocol 15
  • 8,368 executions; no crash
• Allocation tests prove scratch-backed RS256/PS256 verification and invalid-alg rejection allocate zero.
• A transient Criterion probe on Apple M1 Pro/macOS arm64 found no measurable wrapper regression:
  • baseline safe helper: 12.326-12.355 microseconds
  • bound verifier: 12.337-12.361 microseconds
  • overlapping intervals; no speedup claim
• Trail of Bits differential-review and sharp-edges workflows found no blocking security regression in the changed boundary.