crypto: validate malformed key and random inputs before native work

[speak-agent]

Software and version

• mbun 2026.07.18.0
• Bun compatibility 1.3.14
• Node compatibility v26.3.0
• Linux x86_64

Problem

Four pinned Node crypto/WebCrypto tests fail because mbun does not consistently reject malformed inputs before key generation, random filling, or EC JWK materialization:

• test-crypto-keygen.js: invalid options.paramEncoding is accepted.
• test-crypto-key-objects-raw.js: importing a raw public key as private reports ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS instead of the option-shape ERR_INVALID_ARG_VALUE.
• test-crypto-random.js: non-number offset and size values are coerced instead of rejected with ERR_INVALID_ARG_TYPE.
• test-webcrypto-export-import-ec.js: an EC private JWK whose public coordinates do not match its private scalar is accepted instead of rejected with DataError.

The fixed W43 focused manifest reproduces all four as fail with one serial job.

Initial analysis

Pinned Node validates these cases at the API boundary:

• lib/internal/crypto/keygen.js validates paramEncoding before creating EcKeyPairGenJob.
• lib/internal/crypto/random.js validates number types and ranges before creating RandomBytesJob.
• src/crypto/crypto_ec.cc verifies that an imported private EC JWK satisfies d * G == (x, y).

mbun's existing crypto implementations already support the successful operations. This issue is limited to restoring those preflight validation and error-classification rules; it does not add algorithms, expand getCurves(), or change the known same-binary key-object conflicts.

Acceptance

• Add focused JSC regression coverage for the four invalid-input rules.
• Make the four named Node files pass without editing the pinned corpus.
• Repeat every new green serially and run the relevant JSC member tests.
• Keep the other crypto/WebCrypto capability, cipher-state, internal-job, secure-heap, and branding failures out of scope.

Related to #80.