Describe a repo the way the commands acting on it resolve it

Five from review, and the first settles the other half of a fix of mine.

A row could name two clusters. cloneURL fell back to the recorded ClusterHost when the catalog had no host for the slug; placementCluster had no such fallback and returned the slug, so a repo whose cluster is missing from /clusters — or whose publicUrl was rejected — printed CLUSTER us-east beside CLONE URL entire://aws-us-east-2.entire.io/... That breaks what the field documents about itself: the value every --cluster takes.

Which half to move was decided by repo clone, not by taste. nativePlacements builds its home placement straight from the record — ClusterHost, ClusterSlug, Jurisdiction — and reads /clusters only to enrich ADDITIONAL mirrors, skipping any it cannot resolve and shrugging off a catalog failure entirely. So such a repo clones fine, and a view reporting no clone URL for it was describing a different repo than the command that acts on it. One hostOf now feeds the cell and the URL, with the record as the primary's fallback; jurisdiction follows the same rule, recovering a value clone already had. Mirrors keep degrading to the slug together, having no record behind them.

--json placements gained lastError. A caller selecting .status=="failed" got the status and nothing saying why — the one thing that decides between retrying and escalating — while the table printed it all along.

The --authoritative hint stopped promising a recovery step that does not exist: the read is unconditional now, so re-running without the flag makes the identical call and differs only in reporting the failure as a warning. It says that instead.

A successful 200 carrying no lifecycle dashed STATUS in silence while the failing read explained itself — the same cell, the harder case to diagnose, since nothing visibly went wrong. It warns too.

And --authoritative=false no longer reports itself ignored: false is the flag's default and asks for exactly what the GitHub path does, so only the value can decide, never Changed(). Nothing covered that warning at either call site; three cases do now.