fix: case-insensitive cluster-host matching in auth-context resolution

DNS hosts are case-insensitive. Fold case at the auth-context determination chokepoint (clusterdiscovery.ResolveContextForCluster / ResolveClusterCores) so every cluster-addressed flow — control-plane cluster commands and the git/repo-token path — resolves the cache key, /.well-known discovery, and cores→context match regardless of case. Also fold case in clone's selectCloneTarget --cluster match, the spot the reviewer flagged.