Summary

• add USELESSKEY-SPEC-0016 to make negative fixtures a first-class taxonomy
• define stable classes for JWK, JWKS, JWT/token, webhook, and X.509/TLS negatives
• update lane metadata so the JWK/JWKS implementation wave is the next ready item

User path

This improves the user job of finding deterministic bad artifacts that map to realistic parser/verifier failures instead of generic broken strings.

Boundary

This is a docs/spec slice only. It does not implement all taxonomy classes, add a contract pack, claim provider compatibility, claim production security, claim scanner evasion, or move repo-local proof into the installed CLI.

Proof

• cargo xtask spec-check --strict
• cargo xtask docs-sync --check
• cargo xtask typos
• git diff --check

Receipts

• docs/specs/USELESSKEY-SPEC-0016-negative-fixture-taxonomy.md
• active goal now marks the taxonomy spec done and the JWK/JWKS negative wave ready

Risk

No fixture generation, deterministic identity, bundle schema, or public API behavior changes.

Rollback

This PR is revertable without invalidating generated receipts because it only defines taxonomy and updates lane metadata.