cli: isolate the token store in tests so spawned binaries skip the keychain

The cli package TestMain mocked the in-process zalando keyring, but several tests spawn the real entire binary (or a git hook that invokes it). testing.Testing() is false in that child, so neither the in-memory keyring mock nor the internal/testdirs fallback applies, and the child's tokenstore default backend reaches the developer's real OS keychain — triggering a macOS unlock prompt during go test ./cmd/entire/cli/.

Set ENTIRE_TOKEN_STORE=file (plus an isolated token/auth/config/cache path) process-wide in TestMain before m.Run, so spawned children inherit file-backed isolation. Mirrors the integration and e2e TestMains. The in-memory keyring mock stays for in-process legacy auth.NewStore paths.