git-remote-entire: ENTIRE_TOKEN env override for CI / workload identity

Let ENTIRE_TOKEN=<jwt> bypass contexts.json and the keyring entirely so CI and workload-identity runners clone entire:// URLs without an interactive login.

When set, derive the home-region core URL from the token's URL-shaped aud claim (login/sa-session JWTs carry aud=<home-region URL>, which is what STS routing keys on) and use the env token verbatim as the login JWT for repo-scoped exchange. A token with no URL-shaped aud is a hard error, not a silent fallback to context resolution.

tokens.ParseClaims already exposes Audience (normalised across string and array forms), so no helper port was needed.