fix(repo): resolve `mirror get` clone URLs via that cluster's core

entire repo mirror get entire://<cluster>/gh/<owner>/<repo> listed mirrors on the active context's core, so a clone URL for a cluster in a different federation failed with "no mirror matching" until the user manually switched contexts with entire auth use. The clone URL already names its cluster; dial the core fronting it — discovered from the cluster's /.well-known/entire-cluster.json and authenticated with the matching local context — the same routing mirror create/remove (PR #1475) and repo clone --cluster (PR #1529) already use. A ULID ref carries no cluster coordinate and stays on the active context.

Adds runCoreObjectForCluster (mirroring runCoreListForCluster) and a clusterCoreClient test seam alongside activeCoreClient so the routing decision is pinned by command-level tests without live discovery.