docs(readme): document headless & CI authentication

ENTIRE_TOKEN_STORE=file, ENTIRE_TOKEN_STORE_PATH, and ENTIRE_TOKEN existed only as an internal package comment. Add a user-facing section covering the two supported paths (file-backed interactive login on keyring-less machines, env-token injection for CI/workload identity) and a troubleshooting callout quoting the error strings entire login actually emits.