fix(auth): delete jurisdiction tokens on logout

[stiak]

I saw today the jurisdiction tokens survive a logout. That was unexpected. Track them in the context file so they can be cleared on logout.

[Copilot]

Pull request overview

This PR closes a security/usability gap in logout by ensuring data-plane “jurisdiction” bearer tokens cached by git-remote-entire are discoverable and deleted during entire logout, despite the credential store lacking enumeration.

Changes:

• Add JurisdictionAudiences tracking to login contexts so logout can locate jurisdiction-token keychain slots.
• Update git-remote-entire jurisdiction token caching to record the audience before persisting the token (and skip persistence if recording fails).
• Extend logout keychain deletion to remove jurisdiction tokens per recorded audience, and add focused tests for ordering, scope, and failure behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/entireclient/tokenstore/tokenstore.go	Adds standardized service-name helper for jurisdiction token slots.
internal/entireclient/tokenstore/testing.go	Adds an observing test backend to assert credential-store operation ordering.
internal/entireclient/contexts/contexts.go	Extends stored context schema with JurisdictionAudiences.
cmd/git-remote-entire/main.go	Wires audience-recording into jurisdiction token source creation for interactive git auth.
cmd/git-remote-entire/main_test.go	Updates env-token path assertion to the new persistence predicate.
cmd/git-remote-entire/jurisdictionauth.go	Reworks persistence selection and enforces record-before-persist semantics for jurisdiction tokens.
cmd/git-remote-entire/jurisdictionauth_test.go	Adds/updates tests for audience recording order and “don’t persist if unrecordable” behavior.
cmd/entire/cli/auth/contexts.go	Preserves JurisdictionAudiences across context upserts on re-login.
cmd/entire/cli/auth/context_store.go	Expands logout deletion to include jurisdiction tokens for recorded audiences.
cmd/entire/cli/auth/context_store_test.go	Adds tests covering multi-audience deletion, cross-account isolation, abort-on-delete-failure, and audience retention on re-login.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

internal/entireclient/tokenstore/tokenstore.go:60

• JurisdictionService normalizes trailing slashes but not surrounding whitespace. If a context ever records an audience with leading/trailing spaces (e.g., a hand-edited/corrupted contexts.json, or input that wasn’t trimmed upstream), logout may compute a different service name and fail to delete the persisted token, leaving a valid jurisdiction bearer behind.

// JurisdictionService returns the service name for a jurisdiction (data-plane)
// access token, keyed by the jurisdiction audience so tokens for different
// jurisdictions — and for prod vs staging — can't be confused. The account key
// is the login context's handle. Trailing slashes are normalized away so
// callers don't have to.
func JurisdictionService(audience string) string {
	return JurisdictionKeyringPrefix + strings.TrimRight(audience, "/")
}