Summary

• add taxonomy stable IDs for NegativeJwk and NegativeJwks
• add explicit MalformedBase64url naming while keeping MalformedField as the compatibility path for the same generated shape
• add NegativeJwks::MixedValidInvalid for a realistic key-set negative containing one valid key and one malformed key
• update tests and README coverage, then advance the lane goal to the token-shape negative wave

User path

Rust developers can now generate and name taxonomy-backed JWK/JWKS negative fixtures for downstream parser/verifier tests without hand-rolling broken key shapes.

Boundary

This does not add an OIDC provider compatibility claim, change contract-pack files, add production security claims, or change existing positive fixture derivation.

Proof

• cargo test -p uselesskey-jwk --all-features
• cargo test -p uselesskey --all-features
• cargo +nightly xtask pr-lite
• git diff --check

Receipts

• NegativeJwk::stable_id() / NegativeJwks::stable_id() expose SPEC-0016 names
• JWK tests cover the stable IDs and mixed valid/invalid JWKS shape

Risk

This adds public enum surface for a new JWKS negative and a named malformed-base64url variant. Existing generated negative values and positive deterministic fixture identity are unchanged.

Rollback

This PR can be reverted independently; later token and bundle work should continue from SPEC-0016 without relying on this branch until merged.