test(e2e): keep the spawned entire binary off the real OS keychain

1ea54e2 added keyring.MockInit() to the cli package TestMain so in-process tests don't read the developer's keychain. But the e2e suite (run by mise run test:ci via the canary, and by mise run test:e2e) drives the REAL entire binary as a subprocess, which MockInit can't touch — so a credential-resolving flow (e.g. the pre-push hook) still triggers a macOS keychain unlock prompt. Two stores are reachable: the unconditional internal/entireclient/tokenstore, and the auth package's legacy keyring store (auth.NewStore().GetToken fallback in contexts.go), which queries the keychain even when no token is present.

Neutralize both in the e2e environment:

• Add a shared build:e2e task that builds entire with -tags=authfilestore (so the auth file backend is compiled in), and point the canary, roger-roger, and default e2e tasks at it. Production mise run build stays untagged.
• In e2e TestMain, set ENTIRE_TOKEN_STORE=file/_PATH (covers tokenstore, no tag needed) and ENTIRE_TEST_AUTH_STORE_FILE (covers the auth keyring store under the authfilestore tag), pointing at files in the run's artifact dir. Child processes (the binary, git hooks) inherit these.

With these set, resolveBackendLocked returns a fileStore and chooseBackend returns the file backend, so no keyring/keychain call can occur. Canary verified green.