cli: resolve entire-api cell/jurisdiction from a repo's mirror

entire-api is addressed per-cell, and (per the chosen design) the cell comes from the target repo's mirror — the same source entire.io/api's resolveCell uses. Add the placement selector: given a repo's mirrors (listed via the existing listMirrorsForRepo), pick one carrying both a cell and a jurisdiction, preferring a named cluster and otherwise taking the first routable row — matching resolveCell's preferred ?? matches[0] and its filter-before-select ordering.

Pure selector + forge→provider mapping only (both unit-tested); the repo-resolution glue that calls the control plane lands with the client wiring so nothing here is dead.