git-remote-entire: gate ENTIRE_TOKEN aud against cluster-trusted cores

Adversarial review flagged that the ENTIRE_TOKEN path turned the token's unverified aud claim directly into the STS exchange host (SSRF / token exfiltration) and permitted cleartext http exchange.

Fixes:

• CoreURLFromEnvToken now enforces a strict origin: https scheme, host present, no userinfo/path/query/fragment. http (cleartext) and richer URLs are hard errors.
• Before exchanging, verify the aud is one of the cores the target cluster advertises at /.well-known/entire-cluster.json (fetched over TLS, keyed on the clone-URL host the user typed, reusing clusterdiscovery). A forged aud can no longer redirect the token to an attacker host; it aborts.
• Export clusterdiscovery.ResolveClusterCores for the cores-only lookup.

Trust model: claims are used only as a routing hint, constrained to TLS-vouched trusted cores; the core's STS remains the authoritative signature verifier. No client-side JWKS verification (matches the non-env login-context path).

Tests: strict aud validation (http/path/query/fragment/userinfo/opaque), plus the integrated gate against a fake well-known TLS server (trusted->ok, untrusted->abort, discovery failure->abort).