Summary

• add NegativeToken::MissingKid for deterministic JWT-shaped missing-header-kid fixtures
• add NegativeToken::stable_id() values that align token negatives with SPEC-0016 taxonomy IDs
• cover the new public TokenFixture::negative_value path, README example, and failure atlas row
• advance the real workflow goal to the OIDC/JWKS validator example slice

User path

Rust developers can request a deterministic missing-kid JWT-shaped negative through the token fixture API, then use it to exercise verifier rejection paths without changing positive token fixtures.

Boundary

This does not change positive token derivation, OIDC bundle layout, provider compatibility claims, production security claims, or scanner-evasion posture.

Proof

• cargo test -p uselesskey-token --all-features
• cargo test -p uselesskey --all-features
• cargo fmt --all -- --check
• cargo +nightly xtask pr-lite
• git diff --check

Receipts

NegativeToken::stable_id() now exposes taxonomy-backed IDs, and tests cover the missing-kid token shape, deterministic output, positive cache isolation, and distinct negative output.

Risk

This adds a public enum variant and public helper method. Existing variant_name() strings and positive token fixture identity are unchanged.

Rollback

The PR can be reverted independently before the OIDC/JWKS validator workflow consumes the missing-kid negative.