cli/auth: add `token --jurisdiction` for jurisdictional identity tokens

entire auth token printed only the control-plane bearer, which the per-jurisdiction entire-api cells (e.g. https://aws-us-east-2.api.entire.io/api/v1) reject. Add --jurisdiction <slug> to mint a jurisdictional identity token (RFC 8693 exchange, scope=openid, aud=<jurisdiction host>) for that jurisdiction's cells, reusing the existing exchange pipeline in cell_data_api.go. It exchanges ENTIRE_TOKEN when set (deriving the environment from the env token's aud so it works with no ENTIRE_API_BASE_URL, else the active stored login.

Also surface the caller's home jurisdiction in Logged in to https://us.auth.entire.io User: Georg Friedrich @georg Identity: github/1940 Context: us.auth.entire.io Token: stored in OS keychain

Active sessions (32): NAME CREATED LAST USED EXPIRES OIDC login 2026-06-30 2026-06-30 2026-07-03 2026-08-02 OIDC login 2026-06-30 2026-06-30 2026-07-03 2026-08-02 OIDC login 2026-07-01 2026-07-01 2026-07-03 2026-08-02 Console login 2026-07-02 2026-07-02 2026-07-02 2026-07-09 Console login 2026-07-01 2026-07-01 2026-07-01 2026-07-08 OIDC login 2026-06-29 2026-06-29 2026-06-30 2026-07-30 Console login 2026-06-30 2026-06-30 2026-06-30 2026-07-07 OIDC login 2026-06-25 2026-06-25 2026-06-29 2026-07-29 Console login 2026-06-29 2026-06-29 2026-06-29 2026-07-06 OIDC login 2026-06-22 2026-06-22 2026-06-29 2026-07-29 OIDC login 2026-06-18 2026-06-18 2026-06-25 2026-07-25 OIDC login 2026-06-24 2026-06-24 2026-06-24 2026-07-24 OIDC login 2026-06-16 2026-06-16 2026-06-21 2026-07-21 OIDC login 2026-06-19 2026-06-19 2026-06-19 2026-07-19 OIDC login 2026-06-14 2026-06-14 2026-06-18 2026-07-18 OIDC login 2026-06-13 2026-06-13 2026-06-13 2026-07-13 OIDC login 2026-06-11 2026-06-11 2026-06-12 2026-07-12 OIDC login 2026-06-11 2026-06-11 2026-06-11 2026-07-11 OIDC login 2026-06-09 2026-06-09 2026-06-09 2026-07-09 OIDC login 2026-06-08 2026-06-08 2026-06-08 2026-07-08 OIDC login 2026-06-08 2026-06-08 2026-06-08 2026-07-08 OIDC login 2026-06-08 2026-06-08 2026-06-08 2026-07-08 OIDC login 2026-06-07 2026-06-07 2026-06-07 2026-07-07 OIDC login 2026-06-06 2026-06-06 2026-06-06 2026-07-06 OIDC login 2026-06-06 2026-06-06 2026-06-06 2026-07-06 OIDC login 2026-06-06 2026-06-06 2026-06-06 2026-07-06 OIDC login 2026-06-05 2026-06-05 2026-06-05 2026-07-05 OIDC login 2026-06-05 2026-06-05 2026-06-05 2026-07-05 OIDC login 2026-06-05 2026-06-05 2026-06-05 2026-07-05 OIDC login 2026-06-05 2026-06-05 2026-06-05 2026-07-05 OIDC login 2026-06-05 2026-06-05 2026-06-05 2026-07-05 OIDC login 2026-06-04 2026-06-04 2026-06-04 2026-07-04

Run 'entire logout' to end this session, or 'entire logout --everywhere' to end all of them.

2 login contexts saved; run 'entire auth contexts' to list or 'entire auth use <name>' to switch.

Update available! 0.7.9-nightly.202607020716.b58b5fe8e -> 0.7.9-nightly.202607030712.7b6b53b52 Release notes: https://github.com/entireio/cli/releases/tag/v0.7.9-nightly.202607030712.7b6b53b52 To update, run: brew upgrade entire@nightly so the slug is discoverable non-interactively.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com Claude-Session: https://claude.ai/code/session_014ByabUEH7Egwn2rMt8o6bB EOF )