docs(repo): clarify entire:// passthrough deliberately skips host validation

The verbatim entire:// URL is forwarded to git clone exactly as typed (equivalent to a raw git clone entire://…); validateClusterHost only guards the shorthand path where we synthesize the URL ourselves.