Production JWT Grant fails with invalid_request (no description) after successful Go-Live — everything verified correct

After our Go-Live Form was approved, JWT Grant authentication to https://account.docusign.com/oauth/token consistently fails with:

{"error": "invalid_request"}

No error_description is returned. The identical code and request structure work without any issue against the demo environment (account-d.docusign.com).

Setup:

• Integration Key: 9711fda1-8ceb-44d8-bb4f-1f8c54e29956
• Production API Account ID: a0f9faaf-32b6-43cf-b88c-f5d5cf726596
• Auth method: JWT Grant, scopes signature impersonation

What I've already verified/ruled out:

• RSA keypair is registered under the app in the production account (freshly generated, single key registered, no stale/duplicate keys)
• User consent has been granted — visited the /oauth/auth consent URL logged in as the impersonated user, clicked Allow, and the redirect returned a valid authorization code
• Integration Key, impersonated User ID, and API Account ID all match exactly what's shown in production under Settings → Apps and Keys
• JWT payload (iss, sub, aud, scope, iat/exp) manually decoded and confirmed correctly formed, no clock skew
• Using the correct production OAuth host (account.docusign.com, not the demo one)
• Same integration key + same code path authenticates successfully against demo

DocuSign Support (case #17933786) confirmed no issue on the account/entitlement side but couldn't investigate further due to support tier. Has anyone run into this specific invalid_request (not invalid_grant) response after a Go-Live promotion, and found what actually causes it?