Wire entire repo mirror (create/list/get/remove)

Add the GitHub-mirror placement surface under entire repo mirror, matching the standalone entiredb CLI's command shape on the control-plane half:

entire repo mirror create <github-url> <cluster-host> [--no-wait] entire repo mirror list [--cluster] [--provider] [--owner] entire repo mirror get <mirror-id> entire repo mirror remove <github-url> <cluster-host>

create POSTs the placement (CreateMirror), then — unless --no-wait — blocks until the initial GitHub→EntireDB clone is usable, so git clone works on return. The readiness probe (repo_mirror_probe.go) is the one place the control-plane CLI reaches into the data plane: it mints a repo-scoped pull token via auth.RepoScopedToken and polls the cluster's smart-HTTP info/refs endpoint, decoding the advertisement with go-git packp until HEAD resolves. remove resolves the mirror's ULID from its GitHub coords (LookupRepoByMirror) before DeleteMirror.

The local-clone rewrite half of entiredb's mirror use (git-config + git-remote-entire) is intentionally not ported — it's outside the control-plane API and git clone of an entire:// URL already works via git-remote-entire without the CLI's help.

list/get/remove use the shared runCore/runCoreJSON helpers; create prints human-readable progress because of the interactive clone wait.