fix(repo): resolve --cluster clone target via that cluster's core

An explicit --cluster may name a cluster in a different federation than the active auth context. Listing mirrors from the active core misses it, failing with "not mirrored on <host>". Dial the core fronting the named cluster (coreapi.NewForCluster) so the lookup hits the right federation. Also validate the user-supplied --cluster up front.