git-remote-entire: cache cluster->context binding after first success

Previously every git op against an entire:// cluster re-ran /.well-known discovery, and successful lookups were never persisted. Bind the clusterHost->context mapping into contexts.json on the first successful scoped-token exchange, so subsequent invocations short-circuit on the stored binding and skip discovery.

Conservative (post-success) variant: the bind fires only after the cluster has provably authenticated the resolved context, so a host whose /.well-known matches a local context but then fails to authenticate leaves no stale binding. Resolution itself stays non-persisting; makeBindHook (guarded by sync.Once on a freshly-constructed token cache) owns the write.