cli: apply --wait-timeout before the first clone-probe token mint

waitForMirrorClone minted its first repo-scoped token before arming the wait deadline. That was tolerable when the mint was a single STS exchange, but it now spans cluster discovery and a possible login refresh — a slow auth path could block well past a small --wait-timeout before the timer even started. Arm the deadline first so the authorization phase consumes the user's wait budget.

The mint goes through a package seam so the regression test can pin a hung auth path against a 50ms timeout.