Entire

Done. The rebase and CHANGELOG revert are complete and verified.

Summary

Rebased chore/unhide-auth-token onto origin/main and reverted the CHANGELOG.md changes. The rebase wasn't clean — it surfaced two real conflicts that needed careful resolution:

1. Modify/delete conflict on repo_token_test.go

origin/main's commit 350f6ff81de deleted repo_token.go + repo_token_test.go as dead code (repo-scoped minting moved to internal/entireclient/repocreds).
But the branch's cell_data_api_test.go depends on the captureTransport test helper that lived in the deleted file.
Resolution: accepted the deletion of repo_token_test.go, and moved captureTransport (with the branch's new token field) into cell_data_api_test.go — its only surviving consumer.

2. Parallel evolution of cell_data_api.go

origin/main (40f78dabc54) had already refactored the token-exchange into a shared httputil helper and renamed the scope const jurisdictionIdentityScope → exported JurisdictionIdentityScope.
The branch independently added JurisdictionToken + the resolveCellSubject family + the --jurisdiction flag.
Git merged the production code coherently (no duplicate defs), but the branch's test still referenced the old lowercase const — fixed the 4 references to the exported name.

CHANGELOG revert: the [Unreleased] entry lived entirely in the last commit, so I restored CHANGELOG.md to origin/main's version before finishing the rebase. git diff origin/main -- CHANGELOG.md is now empty.

Verification:

mise run fmt — no changes
mise run lint — 0 issues
go test ./cmd/entire/cli/auth/ ./cmd/entire/cli/ — both pass (the packages that carry all the resolved code)

origin/main is now an ancestor of HEAD, all 4 branch commits are preserved, and the working tree is clean. Nothing has been pushed. The pre-rebase state is saved at backup/chore-unhide-auth-token-2b08ff14d11 (and in the reflog) if you want to compare.

One note: the branch has been rewritten, so pushing will need --force-with-lease since origin/chore/unhide-auth-token still points at the old commits.

Done. -j is now the short form for --jurisdiction.

Change (cmd/entire/cli/auth.go:207): switched StringVar → StringVarP with "j" as the shorthand. Cobra now renders it as -j, --jurisdiction in help and accepts both forms. I confirmed -j wasn't already claimed by the hidden --insecure-http-auth flag or any persistent flag.

Test (cmd/entire/cli/auth_token_test.go): added a -j shorthand behaves like --jurisdiction subtest mirroring the happy path.

Verified: mise run lint — 0 issues; TestAuthTokenCmd_Jurisdiction — all 3 subtests pass (including the new one).

This is an uncommitted working-tree change on top of the rebased branch. Let me know if you want it folded into the jurisdiction commit or committed separately.