You will need to log out of all the orgs you are logged in to see the flow in action with cookies coming your way!
The OAuth page in Salesforce will ideally land you on to the login.salesforce.com page for login and test.salesforce.com for a sandbox!
You can provide your username and password to allow log in to Salesforce and authorize!
I'm not set up to test the scenario you've laid out precisely, but I was able to repoduce the error using what I imagine is equivalent code in the developer console. Looks like the -r/--instanceurl flag maps to the aud (audience) parameter for the JWT.
Instead of trying to use the domain for a specific instance (which doesn't work in my testing), you should ...
An OAuth access token can be thought of as if it were a session id. If that session hasn't been revoked or timed out, then it won't change. The way Salesforce handles OAuth requests is less "give me a new session" and more "check if I already have a session. If I do, give me the session id, else make a new one".
All sessions in Salesforce ...