v0.5.1: Release 0.5.1: skip unusable JWKS keys, stabilize transport tests

Release 0.5.1: skip unusable JWKS keys, stabilize transport tests

Two residuals the owner rejected in the 0.5.0 release, closed:

A JWKS key this verifier cannot use for signature work is skipped and the
rest of the set still fetches and resolves: an alg naming another algorithm
(encryption keys, names outside both registries) or a well-formed key of an
unsupported kty/curve (RFC 7517 Section 5). Leaked private members, a
malformed non-string alg, and other malformed entries still reject the whole
set loudly — the private-member precheck runs before any skip decision, so
skipping can never hide leaked material. The max_keys bound still counts
every listed key; an all-skipped set resolves empty and lookups fail closed.

The Plug target-fidelity suite no longer flakes on saturated CI runners:
each real-Bandit-transport assertion drains the helper's per-request report
messages so every assert scans a bounded mailbox, and the observed-result
window is 15 seconds (a starved handler process can trail the client's
received response past the old 5-second window). No library code changed.

Version 0.5.1 with corpus pin, conformance pin, install strings, runbook
asserts, and livebooks moved together. Gate exit 0 on this tree; one-family
review of the diff (private-member hole, kty skip, coverage, README drift,
comments, changelog hygiene) repaired before the gate.