The API payload is "pubKeyCredParams": [ { "type": "public-key", "alg": -7 } ] which per the spec is ES256. Maybe a Chrome bug?

Reading comprehension fail - the warning quite clearly says that we should support both ES256 and RS256, and we only support one of them.

There relevant parts of the code seem to be WebAuthnKey::authenticationCeremony() which does support a bunch of different algos:

$coseAlgorithmManager = new Manager();
$coseAlgorithmManager->add( new ES256() );
$coseAlgorithmManager->add( new ES512() );
$coseAlgorithmManager->add( new EdDSA() );
$coseAlgorithmManager->add( new RS1() );
$coseAlgorithmManager->add( new RS256() );
$coseAlgorithmManager->add( new RS512() );

and Authenticator::getRegisterInfo() which tells the client we only support ES256:

$publicKeyCredParametersList = [
	new PublicKeyCredentialParameters(
		'public-key',
		Algorithms::COSE_ALGORITHM_ES256
	)
];

so this seems self-inflicted.

The practical effect seems to be that we don't support Windows Hello. From the above Chrome doc page:

However, developers should be aware that excluding either of the default identifiers has compatibility risks. In particular, RS256 is necessary for compatibility with Microsoft Windows platform authenticators. ES256 is a widely supported algorithm and is compatible with most other platform authenticators and roaming authenticators.