fix(e2e): the id_token typ is the standard JWT, not id+jwt

[y1o1]

The first E2E run after the auth.provider v0.10.0 / auth.policy-verifier v0.4.0 release cut failed on one assertion out of twenty:

AssertionError: expected 'JWT' to be 'id+jwt'
 ❯ tests/token-flow/index.test.js:92

Not a regression — a pin this repo had never exercised. auth.provider#394 changed the id_token's typ from the nonstandard id+jwt to the standard JWT; it merged to the provider's develop at 2026-08-29 00:41 JST, and this repo's last E2E run was 2026-08-28 21:29 JST. Since make setup clones siblings at their default branch, the suite picked the change up the first time it ran afterwards.

The pin stays — it is the only discriminator between the three token kinds, and the negative tests in tests/abac rest on it. What keeps an id_token out of /verify is being disjoint from at+jwt, and JWT satisfies that exactly as id+jwt did, so those refusals are unchanged (verified: the abac assertion still expects 401 / invalid_token).

It pins the value the provider mints, so there is deliberately no dual accept here. The verifier accepts both spellings during the migration window auth.provider#402 closes; the provider stamps one, and noticing when that one changes is what this suite is for.

docs/claims-contract.md and its Japanese twin carried the same id+jwt statement and are updated with the window and the reason.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the E2E suite and claims-contract documentation to reflect that auth.provider now mints ID tokens with the standard JWT header typ: "JWT" (instead of the prior nonstandard id+jwt), keeping this repo’s pins aligned with the provider→verifier contract and ensuring CI continues to catch any future envelope changes.

Changes:

• Update E2E assertions to pin id_token header typ to "JWT" (matching provider behavior since auth.provider v0.10.0).
• Clarify in test comments and documentation why "JWT" remains safely disjoint from RFC 9068 at+jwt, preserving /verify rejection behavior for ID tokens.
• Update both English and Japanese claims-contract docs to describe the migration window and rationale.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
tests/token-flow/index.test.js	Pins ID token typ to JWT and documents the provider change and intent of the pin.
tests/abac/index.test.js	Updates ABAC negative test to assert ID token typ is JWT while keeping /verify rejection expectations intact.
docs/claims-contract.md	Updates the documented typ contract to reflect JWT for ID tokens since provider v0.10.0 and notes the migration window.
docs/claims-contract.ja.md	Japanese counterpart of the claims-contract update for typ on ID tokens.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.