Summary

• turn examples/external/oidc-jwks-validation into a downstream-shaped validator workflow
• add a tiny JWKS validator that accepts the valid RSA JWKS and returns stable rejection classes
• add tests for duplicate kid, wrong kty, unsupported alg, and missing kid taxonomy-backed negatives
• link the example from the OIDC/JWKS how-to and advance the active goal to the bundle product surface spec

User path

A Rust user can copy the clean-project example, run cargo test, and see how uselesskey fixtures drive both the valid OIDC/JWKS path and realistic validator rejection paths.

Boundary

This remains fixture workflow proof. It does not claim OpenID discovery behavior, provider compatibility, production signing-key custody, production verifier correctness, scanner evasion, or release readiness.

Proof

• cargo +nightly test --manifest-path examples/external/oidc-jwks-validation/Cargo.toml
• cargo +nightly clippy --manifest-path examples/external/oidc-jwks-validation/Cargo.toml --all-targets -- -D warnings
• RUSTUP_TOOLCHAIN=nightly cargo xtask external-adoption-smoke --path .
• RUSTUP_TOOLCHAIN=nightly cargo xtask adoption-regression --external
• cargo +nightly xtask docs-sync --check
• cargo +nightly xtask typos
• cargo +nightly fmt --all -- --check
• git diff --check

Known local gate gap

cargo +nightly xtask pr-lite currently fails in publish-check while dry-running unchanged uselesskey-rsa: the packaged crate resolves uselesskey-core@0.9.1 from crates.io and cannot find the newer local impl_pkcs8_spki_fixture_accessors macro. This PR only changes the external example, docs, and active goal state; the passing checks above cover the touched user path.

Receipts

• external adoption smoke includes external-example-oidc-jwks-validation
• adoption regression includes the external smoke path and OIDC bundle proof

Risk

No deterministic fixture identity changes. The only dependency addition is serde_json inside the standalone external example so the downstream validator can name serde_json::Value directly.

Rollback

This PR can be reverted independently before the bundle product surface spec work begins.