cli/auth: unhide entire auth token and add --jurisdiction

[georg]

https://entire.io/gh/entireio/cli/trails/743

What

Two related changes to entire auth token:

1. Unhide the command so it appears in entire auth --help and entire agent-help, surfacing the supported way to authenticate ad-hoc requests.
2. Add --jurisdiction <slug> (e.g. us, eu) to mint a jurisdictional identity token for that jurisdiction's entire-api cells, plus a Jurisdiction: line in entire auth status so the slug is discoverable.

# control-plane bearer (default)
curl -H "Authorization: Bearer $(entire auth token)" "https://us.console.entire.io/api/v1/clusters"

# jurisdictional cell token
curl -H "Authorization: Bearer $(entire auth token --jurisdiction us)" "https://aws-us-east-2.api.entire.io/api/v1/me/activity"

Why

entire auth token was a hidden, scripting-only escape hatch that printed the control-plane bearer. Two gaps:

• It wasn't discoverable — users and agents had no surfaced way to authenticate ad-hoc curl against the core API.
• The per-jurisdiction data-plane cells (e.g. https://aws-us-east-2.api.entire.io/api/v1) reject the control-plane bearer; they require a jurisdictional identity token (RFC 8693 exchange, scope=openid, aud=<jurisdiction host>, per COR-666). There was no way to obtain that token.

Details

Unhide (05f3feb, 58f798b, ccc62a4)

• Remove Hidden: true from newAuthTokenCmd; reword the doc comment to drop the "not part of the everyday surface" framing while keeping the "treat the output as a secret" caveat. --insecure-http-auth on the command stays hidden. RunE is otherwise unchanged; agent-help renders live from the Cobra tree so it picks up the visibility change automatically.

--jurisdiction (2b08ff1)

• New exported auth.JurisdictionToken, built by extracting a shared subject-resolution helper out of NewEntireAPICellClient (whose behavior is unchanged). No new exchange/URL/security logic — it reuses the audited exchangeJurisdictionToken / jurisdictionAudience / jurisdictionCoreURL helpers and returns the raw token instead of a client (skipping the cell-URL round-trip a client would need).
• ENTIRE_TOKEN is honored as the exchange subject (exclusive, fail-closed), with the environment (prod/staging/loopback) derived from the token's own aud — so CI works with only ENTIRE_TOKEN set, no ENTIRE_API_BASE_URL. Only the --jurisdiction path gains this; NewEntireAPICellClient / entire api --to cell are unchanged.
• The slug is a bare lowercase jurisdiction (normalized: US/" us " -> us); the one token works against any cell in that jurisdiction.
• entire auth status now shows the caller's home jurisdiction so the slug is discoverable non-interactively.

Testing

• Unit tests for JurisdictionToken (stored-context + ENTIRE_TOKEN subject paths, asserting subject_token, scope=openid, and the jurisdiction audience).
• Command-level tests for --jurisdiction (env-token success + not-logged-in hint) and the new auth status slug line.
• mise run lint clean; the cmd/entire/cli and cmd/entire/cli/auth packages pass.

Note: mise run test:ci fails locally only in unrelated cmd/entire/cli/strategy git-hook tests, caused by a global ~/.git_template leaking hooks into test repos — those tests are untouched by this change and fail the same way on the base branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_014ByabUEH7Egwn2rMt8o6bB

[Copilot]

Pull request overview

This PR makes entire auth token discoverable by unhiding the Cobra subcommand so it appears in entire auth --help and is included in entire agent-help’s live-rendered command tree, while keeping the command’s runtime behavior unchanged.

Changes:

• Unhide entire auth token by removing Hidden: true from the Cobra command definition.
• Reword the newAuthTokenCmd Go doc comment to emphasize that the output is a live credential and should be treated as a secret.
• Update developer-facing docs/comments to remove the “hidden” framing.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
cmd/entire/cli/auth.go	Unhides the auth token command and updates the surrounding doc comment.
cmd/entire/cli/auth_token_test.go	Updates the test doc comment to match the command no longer being hidden.
CLAUDE.md	Updates command-surface documentation to reflect auth token is no longer hidden.

[toothbrush]

good idea, thanks Georg!

[Soph]

as written in slack, I'd rather want the agent to use:

entire api api/v1/clusters
entire api --to cell "/api/v1/me/activity?timezone=UTC&timeframe=last-3-months"

Instead of juggling the token and using curl, or? Like fine making auth token visible but rather updated the agent-help to point it to entire api. I'll make a PR for that.