Record what the consolidated verifier's tests actually establish

KEY-WP-0019-T05 rested on "existing tests pass unchanged", which shows the move
onto internal/jose preserved behaviour but not that the behaviour is checked.
Disabling the RSA comparison in jose.Verify fails both callers' suites, so the
shared verifier is load-bearing on each path.

Correct the comment on the caller-side cases added with the move. It claimed the
existing tamper case fails on the signature segment's shape before any key is
used; it does not — appending eight characters leaves a decodable segment, so
that case does reach and does check the signature. The two new cases are still
worth their place for what a byte-level tamper cannot reach: a structurally valid
token signed by an unpublished key under a published kid tests that key selection
is bound to the key set, and an undersized modulus in the published set tests
that ParseJWKS strictness denies rather than falling through to the claims.

Record both in the workplan and in G01's status.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WAsfsfQmDu4vcBhiMcmQp

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 867844@bnt-lap001
Assistant-Session: 3d45905e-0016-4b49-b828-231406881f7b

src/internal/authclient/client_test.go

@@ -259,11 +259,13 @@ func TestNonceMismatchAndCancelledLogin(t *testing.T) {
 }
 
 // The caller-side verifier moved onto internal/jose (KEY-WP-0019-T05). The
-// existing tamper case appends to the encoded signature, which fails on the
-// segment's shape before any key is used, so it would still pass if the
-// signature check were removed entirely. These cases sign a structurally
-// valid token with a key the provider does not publish, and hand the client a
-// key set it must refuse — the two ways a broken verifier actually shows up.
+// existing tamper case proves the signature is checked at all; these two prove
+// the parts of the move that a byte-level tamper cannot reach. A token signed
+// by an unpublished key under a kid the provider does publish fails only if key
+// selection is bound to the published set, not merely if the bytes are intact.
+// A key set carrying an undersized modulus must deny the login rather than fall
+// through to the claims, which is ParseJWKS strictness being applied on this
+// path and not only in the adapter.
 func TestVerifyRejectsForeignSignatureAndUnusableKeySet(t *testing.T) {
 	c, d, _ := provider(t)
 	ctx := context.Background()